# Mechanical change

Use this procedure only when the exact transformation is already specified and no
placement, behavior, or product decision remains.

## Admission

Record the exact before/after rule, owned resources, relevant baseline, and observable
checks. If the request leaves a real decision unresolved, return
`SPEC_INCOMPLETE` and select implementation or design work; do not guess.

## Work and checking

One owner applies only the specified transformation. One independent final verifier
compares the exact diff with the rule, checks for missing or extra edits, runs the
focused assertion, and compares relevant pre-existing tests with the recorded baseline.
An unrelated red baseline does not block production; only a new or changed failure is a
regression. An extra independent-checking seat is admitted only for a named distinct
risk with a distinct check responsibility and underlying evidence.

Unit fakes may exercise local error paths. When the change affects an integration
boundary, keep the unit result separate from the paired contract fixture and required
real integration result.

## Typed outcomes

- `DONE`: the diff exactly matches the rule and relevant checks pass.
- `SPEC_INCOMPLETE`: a decision remains; return it to selection.
- `DIFF_MISMATCH` or `REGRESSION`: repair within the recorded retry limit, then return
  the typed failure with evidence.
- `BLOCKED`: after bounded diagnosis, an external, authority, environment, or policy
  condition still prevents a required check. Terminate honestly with the attempted
  command, observed result, and concrete unblock requirement. Do not retry forever and
  do not replace the check with a claimed pass.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# New backend component

Build the requested backend component, including the connections needed to use it.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Identify the component's data model, interfaces, rules, endpoints or jobs, dependencies,
and integration points. Use the accepted plan when the selected route is ROADMAP; on
LIGHT use its bounded planning record. Return unresolved material architecture or
product decisions to the run owner before dependent implementation.

Record the project's real build and test baseline. Build owned parts with behavior
tests, including relevant validation, authorization, error handling, idempotency,
concurrency, observability, and migration requirements. Wire the parts into the actual
application and exercise the full requested path. Assign integration ownership explicitly
when different workers produce connected parts; the implementing worker cannot spawn
helpers or acquire another owner's resources.

The independent checker must verify both the pieces and their integrated behavior.
External-system claims require the real target evidence selected by the acceptance
checks; a local demonstration or unit fake cannot establish that external result.

## Independent checking

One independent checker reviews and tests the frozen result by default. An additional
checker requires a named distinct risk or responsibility and separate evidence. Check
the requested behavior, relevant failure cases, and the existing tests of touched
modules and direct dependents. Compare failures with the recorded baseline; an
unrelated pre-existing failure is not a new regression. Investigate every new failure
before acceptance. Meet the request's coverage requirements and the 95% changed-line
floor for executable code, recording the measurement and any applicable exclusions.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Backend bug fix

Correct the reported backend behavior at its cause while preserving existing contracts.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Find the project's real build and test commands and record the baseline on unchanged
code. Reproduce the reported failure with a deterministic regression test where
applicable; retain its failing output and show it passes after the fix. If the failure
does not reproduce, inspect the reported environment, version, input data, or concurrency
once within the diagnosis allowance and report the remaining uncertainty honestly.

Trace the failing path through the affected function, callers, and documented contract.
Use evidence to distinguish validation, data handling, concurrency, configuration, and
upstream failures. Respect language protocols, return types, idempotency, and API
compatibility. Cover the relevant boundary inputs rather than adding a special case
that leaves the underlying defect intact. Neither exception handling nor a conditional
is preferred categorically; choose the behavior the actual contract requires.

Write the regression test before changing behavior when feasible, then make the smallest
complete correction in owned resources. Wrong-layer evidence, repeated failure, or
cross-module uncertainty may justify a named root-cause check or a planning correction;
they do not authorize a retired role, extra reviewer, or larger route automatically.
Record adjacent findings with evidence and request ownership before any further edit.

## Independent checking

One independent checker reviews and tests the frozen result by default. An additional
checker requires a named distinct risk or responsibility and separate evidence. Check
the requested behavior, relevant failure cases, and the existing tests of touched
modules and direct dependents. Compare failures with the recorded baseline; an
unrelated pre-existing failure is not a new regression. Investigate every new failure
before acceptance. Meet the request's coverage requirements and the 95% changed-line
floor for executable code, recording the measurement and any applicable exclusions.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Backend capability change

Add or change the assigned backend capability with explicit input, output, and failure behavior.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Read the existing interfaces and the assignment's acceptance requirements. Resolve
routine technical details from those contracts. Return a material architecture or
product conflict to the run owner with evidence and alternatives; a bounded capability
does not require a roadmap solely because implementation is needed.

Record the real test baseline. Add behavior tests before the implementation when
feasible, covering the requested success cases and applicable invalid input, missing
or duplicate data, authorization, concurrency, and downstream failure cases. Implement
within owned resources, validate external inputs, and preserve documented error and
compatibility contracts. Do not swallow failures to satisfy a happy-path test.

Where the capability crosses an integration boundary, keep local unit results separate
from contract fixtures and the real integration evidence required by the selected checks.

## Independent checking

One independent checker reviews and tests the frozen result by default. An additional
checker requires a named distinct risk or responsibility and separate evidence. Check
the requested behavior, relevant failure cases, and the existing tests of touched
modules and direct dependents. Compare failures with the recorded baseline; an
unrelated pre-existing failure is not a new regression. Investigate every new failure
before acceptance. Meet the request's coverage requirements and the 95% changed-line
floor for executable code, recording the measurement and any applicable exclusions.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Compose work from independent dimensions

The `composition` object in `agents/contracts/gates.json` is authoritative. Select
exactly one base work type, one or more result-format overlays, one or more acceptance
overlays, every applicable risk overlay, and evidence for each selected risk. Reject
unknown ids, duplicates, missing evidence, and incompatible combinations before
dispatch.

Overlay selection adds evidence requirements. It does not replace the route graph or
create a fixed number of workers. By default one independent checker reviews and tests
the exact result. Add another only for a named distinct responsibility that cannot be
checked independently in the same context.

## Writable ownership

Concurrent work is allowed only for disjoint writable resources. Sharing a file does
not collapse all work into one task; it requires an ordered ownership transfer:

1. The first owner records the exact file identity, starting hash, permitted change,
   and completion checks.
2. After finishing, that owner freezes the file, records the resulting hash and check
   evidence, releases write ownership, and stops writing it.
3. The controller verifies the released hash and translates ownership to the next
   named owner with a new permitted change and acceptance record.
4. The next owner accepts only that exact hash, records its own resulting hash, and
   never edits before the release is durable.
5. An independent checker verifies both transitions and the integrated result.

For example, implementation may own `ui/card.css`, release its tested hash, and then
polish may accept that exact hash and own the same file. Implementation and polish are
separate ordered work items, not concurrent writers and not one collapsed assignment.

If the released hash differs, ownership is ambiguous, or the prior owner is still
writing, return `OWNERSHIP_CONFLICT`. Do not merge concurrent bytes or infer a transfer.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Documentation work

Produce documentation that is accurate against authoritative sources and usable by
its named audience. Documentation owns no production behavior unless the user
separately requests that change.

## Planning predicates

Planning depends on ambiguity, never tier. Set these three booleans from the request
and shallow target inspection:

- `audienceUnresolved`: more than one materially different audience remains plausible.
- `informationArchitectureUnresolved`: placement, navigation, or content order cannot
  be derived from an existing documentation structure or explicit request.
- `sourceAuthorityUnresolved`: two or more plausible sources disagree, or no source is
  designated for a material claim.

Run a planning step only when at least one predicate is true. The plan must resolve the
named predicate and cite its evidence. When all are false, proceed directly to writing,
regardless of size tier. If the subject itself is unknown, return a research request.

## Writing and checking

Record the audience, information structure, and authoritative source for each material
claim. Read actual signatures, flags, routes, configuration, and behavior. Include a
copyable example for runnable claims and at least one end-to-end example where the
target supports execution.

One independent final verifier checks audience fit, structure, completeness, clarity,
and every material claim against its source, then executes examples in the real
environment. An extra seat requires a named distinct risk, check responsibility, and underlying
evidence. A unit fake may demonstrate a local error case,
but external-boundary claims require a paired contract fixture and the separately
required real result.

## Outcomes

- `DONE`: audience needs are covered, material claims match their sources, and runnable
  examples pass.
- `INACCURATE` or `EXAMPLE_BROKEN`: repair within the bounded retry policy and recheck.
- `BLOCKED`: an external, authority, environment, or policy condition remains after
  bounded diagnosis. Return the attempted check and concrete unblock requirement;
  never invent a passing example.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# New frontend surface

Build the requested UI surface with its screens, states, navigation, and data connections.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Map the requested journey, entry and completion points, state transitions, data sources,
and relevant first-use, loading, empty, error, populated, and responsive states. Use
ROADMAP dependencies only when that route was selected. Resolve material design or
product conflicts before dependent work and keep routine decisions consistent with
the existing design and platform contracts.

Record the real build and test baseline. Build each owned part with behavior tests and
connect routing, shared state, transitions, and data. Preserve keyboard access, focus
behavior, accessible roles and labels, and responsive layout. When work is divided,
name the integration owner and transfer shared resources in order; workers cannot
start additional agents.

The independent checker completes the actual journey on the rendered application,
including relevant error and empty states and supported viewports. Passing isolated
component tests alone does not prove the requested whole flow works.

## Independent checking

One independent checker reviews and tests the frozen result by default. An additional
checker requires a named distinct risk or responsibility and separate evidence. Check
the requested behavior, relevant failure cases, and the existing tests of touched
modules and direct dependents. Compare failures with the recorded baseline; an
unrelated pre-existing failure is not a new regression. Investigate every new failure
before acceptance. Meet the request's coverage requirements and the 95% changed-line
floor for executable code, recording the measurement and any applicable exclusions.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Frontend bug fix

Correct broken UI behavior and verify the affected interaction on the rendered surface.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Identify the project's real UI runner and build commands and record the unchanged
baseline. Reproduce the reported route, state, and interaction on the rendered UI;
capture the failing assertion, console error, or incorrect visible state. Keep a
regression test when behavior can be tested. If it does not reproduce, investigate the
reported viewport, input data, and asynchronous timing within the diagnosis allowance.

Trace the symptom through components, handlers, state transitions, and data flow.
Inspect relevant platform contracts: effect dependencies, stable keys, controlled
inputs, event behavior, accessible roles and labels, and focus management. Fix the
cause within owned files and check relevant loading, empty, error, populated, overflow,
mobile, and rapid-interaction states.

The independent checker must reproduce the corrected interaction on a real render and
verify relevant keyboard and accessibility behavior. A source inspection cannot establish
that a visual defect is fixed. If rendered evidence remains unavailable after permitted
recovery, preserve source-backed findings and report the unmet rendered check.

## Independent checking

One independent checker reviews and tests the frozen result by default. An additional
checker requires a named distinct risk or responsibility and separate evidence. Check
the requested behavior, relevant failure cases, and the existing tests of touched
modules and direct dependents. Compare failures with the recorded baseline; an
unrelated pre-existing failure is not a new regression. Investigate every new failure
before acceptance. Meet the request's coverage requirements and the 95% changed-line
floor for executable code, recording the measurement and any applicable exclusions.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Frontend capability change

Implement the assigned UI capability so a user can reach it and complete the requested interaction.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Inspect the existing UI and establish the required behavior, entry point, data flow,
and relevant loading, empty, error, populated, overflow, and disabled states. Preserve
existing conventions and identify keyboard, accessible-label, focus, and responsive
requirements. Return material product or design conflicts to the run owner before
implementing dependent behavior.

Record the real build and test baseline. Add behavior tests before implementation when
feasible, then change only owned files. Respect platform contracts for state, effects,
keys, controlled inputs, and events. Connect the capability to its real entry point and
data instead of leaving a working isolated example.

The independent checker uses the rendered UI across the affected states and viewports,
including the relevant keyboard journey. A source review alone cannot prove usability;
record unavailable rendered evidence as an unmet check after permitted recovery.

## Independent checking

One independent checker reviews and tests the frozen result by default. An additional
checker requires a named distinct risk or responsibility and separate evidence. Check
the requested behavior, relevant failure cases, and the existing tests of touched
modules and direct dependents. Compare failures with the recorded baseline; an
unrelated pre-existing failure is not a new regression. Investigate every new failure
before acceptance. Meet the request's coverage requirements and the 95% changed-line
floor for executable code, recording the measurement and any applicable exclusions.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Frontend review

Use this procedure only when the requested action is inspection and reporting. It is
read-only: reviewers, synthesizers, and checkers must not edit the surface, source,
configuration, or deployment.

## Evidence mode

Probe the surface and available browser tooling without mutation.

- A runnable surface and browser permit a live journey review with real screenshots.
- A surface without browser tooling permits a static review. Mark every visual claim
  `UNVERIFIED_VISUALLY` and never fabricate a screenshot.
- An unavailable surface does not turn the request into implementation. Perform the
  source-backed parts that remain valid, record the unavailable evidence, and return a
  typed terminal blocker if the requested result cannot otherwise be produced.

## Review work

Choose personas and journeys that cover distinct user needs. Each reviewer records the
route or source location, observed state, evidence mode, severity, and suggested
improvement. Merge duplicates without dropping affected personas. A fresh checker
replays each high-severity live finding or verifies the cited static source.

The result is one severity-ranked review. Potential fixes are recommendations only.
They may be copied into separately authorized downstream work, with new ownership and
acceptance evidence; this review never performs or dispatches those changes.

## Outcomes

- `DONE`: requested journeys were inspected and every claim names its evidence mode.
- `THIN_REVIEW`: evidence is missing or a live claim cannot be reproduced; repair the
  review within the bounded retry policy.
- `BLOCKED`: an external, authority, policy, or unavailable-surface condition remains
  after bounded diagnosis. Return the attempted check, evidence, and concrete unblock
  requirement; do not loop indefinitely.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Generated procedure contract

Use this procedure only when selection returns `FRAMEWORK: MISS`. Generated procedures
are one-off projections of canonical contracts; they do not invent a competing route or
check sequence.

## Shape

Classify `deliverableKind`, `targetLocus`, and an `acceptanceOverlays` array. The array
must be non-empty, contain no duplicate ids, and preserve every independently requested
effect. Each item has exactly:

```json
{
  "id": "unit-coverage",
  "oracle": "named observable pass condition",
  "evidenceSchema": "agents/contracts/schemas/evidence.schema.json",
  "owner": "ap-independent-checker",
  "retryPolicy": { "maximumAttempts": 2, "retryableResults": ["TRANSIENT_RUNTIME"] }
}
```

Supported overlay ids include `unit-coverage`, `test-set-flip`, `metric-threshold`,
`dry-run-diff`, and `receipts`. Compound acceptance is an array, never a scalar. For
example, a data migration may require both `dry-run-diff` and `receipts`, with distinct
observable checks, evidence, owners, and retries.

## Output

Emit a stable name derived from the three axes, the original acceptance overlays, an
execution-harness reference, typed scenarios, and the canonical compiled route graph.
Do not add surrounding prose that restates, reorders, or omits checks from that graph.

Before generation, compute the immutable MISS cache identity from the route-schema
digest, classified axes, acceptance overlays, and risk overlays. A validated descriptor
is reusable only under that exact identity. An identical identity performs zero new
generator or validator model calls; any route-schema digest change is a cache miss.

Validation rejects unknown overlays, empty observable checks, missing schemas, owners
that are not permitted to check the result, unbounded retries, more than one terminal
`DONE`, or any typed failure without a destination.

## Blocked result

A repairable generated-output defect returns once to the generator. After the bounded
retry, return the typed failure. An external, authority, environment, or policy blocker
terminates with the attempted check, evidence, and concrete unblock requirement. It
does not loop indefinitely and never becomes a claimed pass.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Architecture and design decision

Produce a design for the requested target that an implementer can follow without inventing material decisions.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Read the target system and identify the decisions the request requires. State relevant
performance, scale, compatibility, interface, and operational constraints. If a necessary
fact is unknown, perform or request bounded research within the selected route. This
procedure owns the design result, not production code.

Compare feasible alternatives against those constraints and cite the relevant existing
interfaces. Choose reversible technical alternatives within the assignment's authority;
return unresolved product or consequential choices to the run owner with the decision
needed. Do not fabricate a choice to make the design appear complete.

Document the selected interfaces, data flow, integration points, error behavior,
dependencies, and acceptance checks. An independent checker verifies request coverage,
feasibility, and whether each material decision is supported or explicitly unresolved.
Repair rejected design items while retaining accepted analysis. Completing a design
request does not authorize building or deploying it.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Research for planning

Answer the requested research question with inspectable sources and a useful written result.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

State the question and required output, such as a comparison, catalog, or decision memo.
Use at most three non-overlapping themes when decomposition is useful; do not create
extra agents merely to match that count. The run owner assigns research to permitted
workers according to the selected route.

Each theme has a bounded initial batch of at most six searches and six fetches, subject
to the tighter remaining run limits. Record the source and observed result for every
claimed search or inspection. Produce the named output from the evidence obtained;
progress is substantive findings, not tool-call counts. If a batch produces no useful
output, return its concrete unresolved question without repeating the same broad batch.
One targeted follow-up may address a remaining gap after accepted output exists.

If live search fails, diagnose the tool and use available authorized primary sources
where they can answer the question. A local authoritative source may support stable
facts; it cannot establish current claims that require live verification. Preserve
useful findings and identify evidence that remains unavailable without inventing sources.

Combine findings in the requested format, distinguishing observations, inference, and
uncertainty. Rank alternatives only when comparison or recommendation is requested.
The independent checker verifies material claims against cited sources and confirms
that the result answers the request. Research findings alone do not authorize downstream
implementation.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# ROADMAP planning

Create one dependency-ordered roadmap covering the requested work without expanding its scope.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Treat original-request acceptance as the scope ceiling. Admit an implied work item only
when repository evidence proves it necessary for an accepted ask and a recorded
marginal-value check shows its benefit exceeds its added cost; otherwise exclude it.
This procedure applies after ROADMAP selection, not as a prerequisite for selecting a
route. Pure documentation work uses `docs.md` unless the requested document is the plan.

The roadmap author inspects the relevant repository and writes work items, owners,
dependencies, integration points, implementation details, acceptance requirements,
applicable failure cases, and real verification commands. Preserve the request's
coverage requirements and the 95% changed-line and touched-module coverage floor where
applicable. Ask for a scout only to resolve a named planning question; repository size
or the number of surfaces does not mandate scouts, managers, or extra reviewers.

When the roadmap is written, record the exact count of its concrete behavior-change asks
and divide it by the count of original-request success-checklist asks (with a minimum
denominator of one). Bind both positive integer counts and the resulting ratio to the
frozen `ROADMAP.md` SHA-256, and preserve that measurement across scheduler restart.

One independent checker verifies coverage, dependencies, ownership, integration, and
acceptance checks against the original request. An additional checker requires a named
distinct responsibility. Rejections identify the affected items; repair those items
and retain valid observations. Preserve unresolved user-owned decisions explicitly
rather than inventing answers or starting their dependent work.

Accepting the roadmap permits its ready work only when implementation is included in
the user request. A planning-only request finishes with the verified plan.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# UI polish

Apply the requested visual, copy, or interaction-detail improvements to the existing surface.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Inspect the rendered surface and record the specific improvements and affected states.
Resolve routine choices using the existing design conventions. A material redesign,
new capability, or broken behavior needs the run owner's procedure and scope decision;
it is not implicitly authorized by a polish assignment.

Record the real build and relevant test baseline. Make the listed changes in owned
files. Preserve responsiveness, accessibility, focus, and existing behavior. Add a
behavior check when the change creates or alters testable behavior; use rendered
comparison for purely visual details instead of tests that only repeat the source.

The independent checker compares the requested changes with the actual rendered
surface at the relevant states and viewports, and runs affected behavior and regression
checks. Source inspection alone cannot establish visual quality. Report concrete
remaining defects rather than a subjective claim that the surface feels finished.

## Independent checking

One independent checker reviews and tests the frozen result by default. An additional
checker requires a named distinct risk or responsibility and separate evidence. Check
the requested behavior, relevant failure cases, and the existing tests of touched
modules and direct dependents. Compare failures with the recorded baseline; an
unrelated pre-existing failure is not a new regression. Investigate every new failure
before acceptance. Meet the request's coverage requirements and the 95% changed-line
floor for executable code, recording the measurement and any applicable exclusions.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Procedure quickstart

1. Select the route from the exact request and shallow target facts before creating a
   plan or roadmap.
2. In `README.md`, choose the procedure by the requested action. Evidence availability
   changes the evidence mode, not the requested action.
3. Open the named procedure page. Follow its purpose, evidence rules, ownership rules,
   and typed outcomes. Use only the compiled route graph appended to that page for the
   check sequence.

If no named procedure fits, return `FRAMEWORK: MISS` and use `generation.md`. Do not
default to implementation, invent a route, or copy a sequence from surrounding prose.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Framework selection and evidence contract

Select the route before creating any roadmap. Cold-start selection uses only the exact
user request and shallow target facts allowed by `agents/contracts/routes.json`. A
roadmap, success card, plan, file count, repository size, or failed attempt is never a
prerequisite or selector.

After route selection, choose a procedure by the requested action:

- `apply`: perform an exact, decision-free transformation.
- `backend-fix` or `frontend-fix`: correct observed broken behavior.
- `backend-implement` or `frontend-implement`: change one bounded capability.
- `backend-build` or `frontend-build`: create a whole new component or surface.
- `frontend-review`: inspect and report on a user-facing surface without changing it.
- `polish`: change visual, copy, or interaction details.
- `refactor`: restructure while preserving behavior.
- `plan-scope`, `plan-research`, or `plan-design`: produce the named planning result.
- `docs`: produce documentation.

Browser and runnable-surface availability are evidence conditions, not action
selectors. A requested review always remains read-only. With a browser it may collect
live screenshots; without one it returns a clearly marked static review. Findings may
become separate downstream fix requests, but the review procedure does not implement
them.

## Canonical check graph

The route graphs compiled from `agents/contracts/gates.json` are authoritative. A
procedure describes purpose, evidence, and typed outcomes; it must not declare a
competing sequence. Generated Reasonix procedure pages append exactly one compiled graph.

One independent final verifier owns ordinary completeness: it compares the frozen exact
version being checked with the request and executes the acceptance checks. An extra independent-checking seat
requires a named distinct risk, a distinct check responsibility, and distinct underlying evidence;
edit count, tier, or a second label for the same evidence never adds reviewer,
verification, sign-off, or goal-check work.

For debug fixes the default path is reproduce, implement, then verify. Add detailed
planning or a depth specialist only after recorded wrong-layer evidence, repeated
failure, or cross-module uncertainty. A reproduced bounded local defect does not pay
those gates automatically.

## Test doubles and contract fixtures

A unit fake may isolate local logic or force an error path. It is never a substitute
for integration evidence required by the selected acceptance overlay. Any behavior at
an external boundary needs a paired contract fixture whose schema and provenance are
checked, plus a separate real integration or provider-contract result when that result
is required. Record both results independently; neither can silently satisfy the
other.

## Independent overlays

Scope, acceptance, and risk are independent. Select every applicable risk overlay even
for a one-line change. Authorization, privacy, destructive action, external effects,
performance, concurrency, migration, and rollback each add their own evidence.

Performance work records a baseline, the named SLO or metric threshold, the measured
result under a stated workload, regression bounds, and rollback criteria. External or
destructive work records authority before mutation and a tested recovery or rollback
path.

Blocking findings remain open work. Advisory residual risk may close only with an exact
authority receipt naming every accepted finding. A P1 non-defect decision additionally
binds immutable evidence and its original severity to that receipt; it is never achieved
by relabeling or downgrading severity.

## Event records and migrated logs

Write run events to schema-validated `events.jsonl`. Validate every route, category,
procedure, tier, state, and check id before dispatch or append. Older captured logs are
inputs only after an explicit migration names the source version, target version, row
transform, rejected rows, and resulting digest. Replay the migrated corpus through the
current schema and reject unknown ids; prose logs never bypass validation.

## Composition

Concurrent work requires disjoint writable ownership. Work on the same file uses an
ordered ownership transfer as defined in `composition.md`. A non-matching shape returns
`FRAMEWORK: MISS` and uses `generation.md`; it never silently becomes an implementation
procedure.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

# Behavior-preserving refactor

Make the requested structural improvement while preserving observable behavior.

## Assignment and control

Use the selected route and its canonical compiled checks. DIRECT and LIGHT use no
coordinator, manager, or roadmap. ROADMAP execution follows the accepted plan and
recorded dependencies. Only the run owner selects independent checkers; workers do
not start other agents. Follow the ownership rules in `composition.md`.

## Work and evidence

Read the existing contracts and establish the behavior to preserve before editing.
Run relevant existing tests on the unchanged code. Add characterization tests only
where the current checks leave behavior at risk; they must pass before the refactor.
Record any known quirks that are part of the current contract.

Make the assigned structural changes in owned resources, retaining the behavior checks.
Remove dead code only when evidence establishes it is unused and its removal belongs
to the requested refactor. If the task actually needs changed behavior, report that
conflict to the run owner for the appropriate procedure and acceptance requirements.

The independent checker compares the structural result with the request and verifies
that characterization and regression checks still pass. Test results support the
specific behavior they exercise; do not claim universal equivalence from a finite
suite. Investigate new failures and correct the refactor instead of rewriting expected
behavior solely to make the tests pass.

## Independent checking

One independent checker reviews and tests the frozen result by default. An additional
checker requires a named distinct risk or responsibility and separate evidence. Check
the requested behavior, relevant failure cases, and the existing tests of touched
modules and direct dependents. Compare failures with the recorded baseline; an
unrelated pre-existing failure is not a new regression. Investigate every new failure
before acceptance. Meet the request's coverage requirements and the 95% changed-line
floor for executable code, recording the measurement and any applicable exclusions.

## Recovery and result

A failed command starts diagnosis. Check the command, working directory, supported
runtime, and available dependencies; repair authorized local setup or an owned defect
within the recorded allowance. A changed result or check invalidates its dependent
evidence. Repeat those checks before reporting success. Do not weaken tests, conceal
regressions, or replace a required real result with a simulated pass.

Return repairable failures to the responsible owner. A repeated failure with unchanged
evidence requires strategy reassessment, not equivalent new workers. Preserve valid
results and all run-wide limits. Report `BLOCKED` only when an external, authority,
environment, or policy condition still prevents required work after permitted diagnosis
and recovery; include the command, observed failure, and concrete unblock condition.
Report an unresolved scope or ownership conflict to the run owner without editing
unowned resources. Only new route facts justify changing the route.

Return the exact result version, requested items completed, commands and exit codes,
check evidence, remaining defects, and attempted recovery. The run owner requests
completion only after every requested result passes its current required checks and
all working agents have stopped. The deterministic control plane records `DONE`.

<!-- AUTOPROMPT-FRAMEWORK-GATES:BEGIN v2 sha256=b41cfc5bbf3088c61389449ea26a55f47cdbac2bb5c670ea684bd05d615526e1 -->
## Generated route checks

This compact section is generated from the versioned check registry.

### Applicable route `DIRECT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"success-definition","after":"produce-work"}]`
- Order: `["success-definition","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `14`

### Applicable route `LIGHT`
- Leaves: `["final-record","freeze-version","independent-check","join-check-results","produce-work","short-plan","success-definition"]`
- Edges: `[{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"join-check-results","after":"final-record"},{"before":"produce-work","after":"freeze-version"},{"before":"short-plan","after":"produce-work"},{"before":"success-definition","after":"short-plan"}]`
- Order: `["success-definition","short-plan","produce-work","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `16`

### Applicable route `ROADMAP`
- Leaves: `["coordinate-work","final-record","freeze-version","independent-check","integration","join-check-results","plan-check","produce-work","roadmap-authoring","success-definition"]`
- Edges: `[{"before":"coordinate-work","after":"produce-work"},{"before":"freeze-version","after":"independent-check"},{"before":"independent-check","after":"join-check-results"},{"before":"integration","after":"freeze-version"},{"before":"join-check-results","after":"final-record"},{"before":"plan-check","after":"coordinate-work"},{"before":"produce-work","after":"integration"},{"before":"roadmap-authoring","after":"plan-check"},{"before":"success-definition","after":"roadmap-authoring"}]`
- Order: `["success-definition","roadmap-authoring","plan-check","coordinate-work","produce-work","integration","freeze-version","independent-check","join-check-results","final-record"]`
- Maximum transitions: `23`

<!-- AUTOPROMPT-FRAMEWORK-GATES:END -->

'use strict'

const path = require('node:path')
const { readBound, sha256, ReasonixError } = require('./native.js')
const { verifyCapabilityAttestation } = require('../../codex/workflow/router.js')
const localCanary = require('../../../scripts/harness-v2-canary.cjs')

const REQUIRED = Object.freeze(['isolation', 'topologyEnforcement', 'privateSkillRoot', 'eventStreaming', 'toolOutputCapture', 'stableChildIdentity', 'sameContextContinuation', 'cancellation', 'isolatedChecking', 'processOwnership', 'modelRouting'])
const HASH = /^[a-f0-9]{64}$/
function importedTrustDirectory(root) { return path.join(path.resolve(root), '.autoprompt-private', 'conformance', 'v2', 'reasonix') }

// Release conformance is independent of this activation. A local hash is an
// integrity binding, never evidence that a provider capability was verified.
function runtimeIdentityBody(installed, executable) {
  const dependencies = executable?.runtimeIdentity
  if (installed?.provider !== 'reasonix' || executable?.provider !== 'reasonix' ||
      !path.isAbsolute(executable.path || '') || !HASH.test(executable.sha256 || '') ||
      typeof executable.version !== 'string' || !installed.files || Array.isArray(installed.files) ||
      !dependencies || !HASH.test(dependencies.sha256 || '') ||
      !Number.isSafeInteger(dependencies.fileCount) || dependencies.fileCount < 1 ||
      !Number.isSafeInteger(dependencies.packageCount) || dependencies.packageCount < 0) {
    throw new ReasonixError('PROVIDER_IDENTITY_MISMATCH', 'Reasonix admission requires the complete installed and native runtime identity')
  }
  const excluded = new Set(['agents/contracts/reasonix-live-conformance-evidence.json', 'agents/contracts/reasonix-trusted-public-keys.json'])
  const files = Object.fromEntries(Object.entries(installed.files).filter(([file]) => !excluded.has(file))
    .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))
  for (const [file, hash] of Object.entries(files)) {
    if (path.isAbsolute(file) || file.includes('\\') || file.includes(':') ||
        file.split('/').some(part => !part || part === '.' || part === '..') || !HASH.test(hash)) {
      throw new ReasonixError('PAYLOAD_INVALID', 'Reasonix runtime inventory contains an invalid path or digest')
    }
  }
  return { provider: 'reasonix', executablePath: executable.path, executableSha256: executable.sha256,
    nativeRuntimeIdentity: { sha256: dependencies.sha256, fileCount: dependencies.fileCount, packageCount: dependencies.packageCount },
    version: executable.version, platform: process.platform, architecture: process.arch, files }
}

function runtimeIdentity(installed, executable) { return sha256(JSON.stringify(runtimeIdentityBody(installed, executable))) }

const REVIEWED_LOCAL_EVIDENCE = 'scripts/harness-v2-trust/evidence.json'
function reviewedLocalPending(installed, executable, options = {}) {
  let evidence
  try { evidence = JSON.parse(readBound(path.join(installed.bundle, REVIEWED_LOCAL_EVIDENCE))) } catch { return null }
  if (evidence?.reviewedLocalRecords === undefined) return null
  if (!Array.isArray(evidence.reviewedLocalRecords)) throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix reviewed-local release records are invalid')
  try {
    const review = localCanary.selectReview(evidence.reviewedLocalRecords, 'reasonix', installed, executable)
    return review ? localCanary.verifyReview(review, 'reasonix', installed, executable, options.now) : null
  }
  catch (error) { throw new ReasonixError('PROVIDER_UNSUPPORTED', `Reasonix reviewed-local release record is rejected: ${error.message}`) }
}
// This legacy placeholder proves neither capability nor trust. It only gates
// the reviewed-local pending path when no private import was supplied.
function awaitingIndependentConformance(installed) {
  let evidence, ring
  try {
    evidence = JSON.parse(readBound(path.join(installed.bundle, 'agents/contracts/reasonix-live-conformance-evidence.json')))
    ring = JSON.parse(readBound(path.join(installed.bundle, 'agents/contracts/reasonix-trusted-public-keys.json')))
  } catch { return false }
  return Boolean(evidence?.schemaVersion === 'reasonix-live-conformance-evidence.v1' && evidence.providerId === 'reasonix' &&
    evidence.status === 'awaiting-independent-conformance' && evidence.attestation === null && evidence.activationNonce === null &&
    ring?.schemaVersion === 1 && ring.providerId === 'reasonix' && Array.isArray(ring.keys) && ring.keys.length === 0)
}

function verifyAdmission(installed, executable, options = {}) {
  const imported = options.trustDirectory
  if (imported !== undefined && (!path.isAbsolute(imported) || !HASH.test(options.conformanceRequestSha256 || '') ||
      path.resolve(imported) === path.resolve(installed.bundle) || path.resolve(imported).startsWith(`${path.resolve(installed.bundle)}${path.sep}`))) {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix imported conformance trust must be external and bound to an exact reviewed request')
  }
  const evidencePath = imported ? path.join(imported, 'evidence.json') : path.join(installed.bundle, 'agents/contracts/reasonix-live-conformance-evidence.json')
  const keyPath = imported ? path.join(imported, 'trusted-public-keys.json') : path.join(installed.bundle, 'agents/contracts/reasonix-trusted-public-keys.json')
  const evidenceBytes = readBound(evidencePath), keyBytes = readBound(keyPath)
  const evidence = JSON.parse(evidenceBytes)
  const ring = JSON.parse(keyBytes)
  const attestation = evidence.attestation
  const trustedPublicKeys = Object.fromEntries((ring.keys || []).map(key => [key.keyId, key.publicKeyPem]))
  const key = (ring.keys || []).filter(item => item?.keyId === attestation?.signature?.keyId)
  if (evidence.status !== 'passed' || key.length !== 1 || key[0].independent !== true || key[0].issuer !== attestation?.issuer ||
      !Array.isArray(key[0].providers) || !key[0].providers.includes('reasonix') || attestation?.verificationMethod !== 'live-conformance-suite' ||
      /autoprompt.*activation/i.test(attestation?.issuer || '') || attestation?.signature?.algorithm !== 'ed25519') {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix v2 requires an independent signed live-conformance record for this runtime before activation')
  }
  const identity = runtimeIdentity(installed, executable)
  if (imported && attestation?.providerAdmissionSha256 !== options.conformanceRequestSha256) {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix imported certificate is not bound to the reviewed local admission request')
  }
  const verification = verifyCapabilityAttestation(attestation, {
    providerId: 'reasonix', runtimeIdentityHash: identity, activationNonce: evidence.activationNonce,
    requiredCapabilities: REQUIRED, trustedPublicKeys,
  })
  if (!verification.valid) throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix live-conformance admission failed', { errors: verification.errors })
  return { ...verification, runtimeIdentityBody: runtimeIdentityBody(installed, executable), runtimeIdentityHash: identity, evidenceSha256: sha256(JSON.stringify(evidence)),
    trustSource: { kind: imported ? 'explicit-private-import' : 'shipped-release', directory: imported || installed.bundle,
      evidenceSha256: sha256(evidenceBytes), keyRingSha256: sha256(keyBytes), ...(imported ? { conformanceRequestSha256: options.conformanceRequestSha256 } : {}) } }
}

module.exports = { REQUIRED, REVIEWED_LOCAL_EVIDENCE, runtimeIdentityBody, runtimeIdentity, importedTrustDirectory, reviewedLocalPending, awaitingIndependentConformance, verifyAdmission }

'use strict'

const crypto = require('node:crypto')
const fs = require('node:fs')
const path = require('node:path')
const childProcess = require('node:child_process')
const toml = require('@iarna/toml')

const MINIMUM_VERSION = '1.30.0'
const FORBIDDEN_TOOLS = Object.freeze([
  'task', 'fleet', 'run_skill', 'load_skill', 'activate_skill', 'create_skill',
  'skill_create', 'skill_edit', 'skill_delete', 'remember', 'forget',
  'use_capability', 'ask', 'update_goal', 'complete_step', 'todo_write', 'wait',
])
const CONTROLLED_SERVER = 'autoprompt_owned'
const CONTROLLED_PROXY = 'use_capability'
const CONTROLLED_NAMES = Object.freeze(['read', 'list', 'search', 'write', 'edit', 'bash'])
// v1.30 keeps MCP schemas behind one stable proxy. Permission rules still
// resolve against the exact native MCP name, never the proxy or a wildcard.
const CONTROLLED_TOOLS = Object.freeze(CONTROLLED_NAMES
  .map(name => `mcp__${CONTROLLED_SERVER}__${name}`))
const CONTROLLED_NATIVE_TOOLS = Object.freeze(['todo_write'])
const CONTROLLED_CAPABILITIES = Object.freeze(CONTROLLED_NAMES
  .map(name => `mcp-tool:${CONTROLLED_SERVER}/${name}`))
const CONTROLLED_DENIED_TOOLS = Object.freeze([...FORBIDDEN_TOOLS,
  'bash', 'bash_output', 'kill_shell', 'read_file', 'list_dir', 'ls', 'glob', 'grep',
  'write_file', 'edit_file', 'apply_patch', 'multi_edit', 'move_file', 'notebook_edit',
  'delete_range', 'delete_symbol', 'web_fetch', 'web_search', 'code_index', 'compress',
  'read_only_task', 'parallel_tasks', 'read_subagent_result', 'read_only_skill',
  'read_skill', 'install_skill', 'install_source', 'slash_command', 'explore',
  'research', 'review', 'security_review', 'review_report', 'docs', 'history',
  'list_sessions', 'read_session', 'memory', 'lsp_definition', 'lsp_diagnostics',
  'lsp_hover', 'lsp_references', `mcp_connect__${CONTROLLED_SERVER}`,
])
const sha256 = value => crypto.createHash('sha256').update(value).digest('hex')
function validateNativeTodoWrite(args) {
  if (!args || typeof args !== 'object' || Array.isArray(args) || Object.keys(args).length !== 1 || !Array.isArray(args.todos) || args.todos.length < 1 || args.todos.length > 128) throw new ReasonixError('TOOL_POLICY_DENIED', 'Reasonix todo_write arguments are invalid')
  const ids = new Set(); let active = 0
  for (const todo of args.todos) {
    if (!todo || typeof todo !== 'object' || Array.isArray(todo) || Object.keys(todo).some(key => !['content','status','activeForm','level','step_id'].includes(key)) || typeof todo.content !== 'string' || !todo.content.trim() || todo.content.length > 2000 || !['pending','in_progress','completed'].includes(todo.status) || (todo.activeForm !== undefined && (typeof todo.activeForm !== 'string' || todo.activeForm.length > 2000)) || (todo.level !== undefined && todo.level !== 0 && todo.level !== 1) || (todo.step_id !== undefined && (typeof todo.step_id !== 'string' || todo.step_id.length > 256))) throw new ReasonixError('TOOL_POLICY_DENIED', 'Reasonix todo_write item is invalid')
    if (todo.status === 'in_progress') active++
    if (todo.step_id) { if (ids.has(todo.step_id)) throw new ReasonixError('TOOL_POLICY_DENIED', 'Reasonix todo_write reuses a stable step_id'); ids.add(todo.step_id) }
  }
  if (active > 1) throw new ReasonixError('TOOL_POLICY_DENIED', 'Reasonix todo_write has more than one in-progress item')
  return args
}
const inside = (root, candidate) => {
  const relative = path.relative(root, candidate)
  return relative === '' || (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`))
}

class ReasonixError extends Error {
  constructor(code, message, details = {}) {
    super(message)
    this.name = 'ReasonixError'
    this.code = code
    this.details = details
  }
}

function readBound(file) {
  const before = fs.lstatSync(file)
  if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1) {
    throw new ReasonixError('PAYLOAD_INVALID', `Expected one regular file: ${file}`)
  }
  const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0))
  try {
    const opened = fs.fstatSync(fd)
    if (opened.ino !== before.ino || opened.dev !== before.dev) throw new ReasonixError('PAYLOAD_INVALID', 'File changed while opening')
    const bytes = fs.readFileSync(fd)
    const after = fs.lstatSync(file)
    if (opened.ino !== after.ino || opened.dev !== after.dev || after.size !== bytes.length || opened.mtimeMs !== after.mtimeMs || opened.ctimeMs !== after.ctimeMs) {
      throw new ReasonixError('PAYLOAD_INVALID', 'File changed while reading')
    }
    return bytes
  } finally { fs.closeSync(fd) }
}

function privateDirectory(directory) {
  if (fs.existsSync(directory)) {
    const stat = fs.lstatSync(directory)
    if (!stat.isDirectory() || stat.isSymbolicLink()) throw new ReasonixError('PAYLOAD_INVALID', `Private directory is linked or invalid: ${directory}`)
    if (path.dirname(directory) !== directory) privateDirectory(path.dirname(directory))
    return
  }
  privateDirectory(path.dirname(directory))
  fs.mkdirSync(directory, { mode: 0o700 })
}

function writePrivate(file, data) {
  privateDirectory(path.dirname(file))
  fs.writeFileSync(file, data, { flag: 'wx', mode: 0o600 })
}

function locateExecutable(env = process.env, requested) {
  const names = requested ? [requested] : (env.PATH || '').split(path.delimiter)
    .filter(Boolean).flatMap(directory => process.platform === 'win32'
      ? [path.join(directory, 'reasonix.exe')] : [path.join(directory, 'reasonix')])
  for (const name of names) {
    try {
      const resolved = fs.realpathSync.native(name)
      const bytes = readBound(resolved)
      fs.accessSync(resolved, fs.constants.X_OK)
      return { path: resolved, sha256: sha256(bytes) }
    } catch (error) { if (requested) throw error }
  }
  throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix CLI is not installed or is not executable')
}

function probeExecutable(options = {}) {
  const executable = locateExecutable(options.env, options.executable)
  const spawn = options.spawnSync || childProcess.spawnSync
  const version = spawn(executable.path, ['--version'], {
    env: options.env || process.env, encoding: 'utf8', shell: false, timeout: 15000, maxBuffer: 1024 * 1024,
  })
  const match = /\breasonix\s+v?(\d+)\.(\d+)\.(\d+)\b/i.exec(String(version.stdout || ''))
  const tuple = match && match.slice(1).map(Number)
  if (version.error || version.status !== 0 || !tuple || tuple[0] < 1 || (tuple[0] === 1 && tuple[1] < 30)) {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', `Reasonix ${MINIMUM_VERSION} or later is required`)
  }
  const help = spawn(executable.path, ['run', '--help'], {
    env: options.env || process.env, encoding: 'utf8', shell: false, timeout: 15000, maxBuffer: 1024 * 1024,
  })
  const text = `${help.stdout || ''}\n${help.stderr || ''}`
  if (help.error || help.status !== 0 || !['--output-format', '--resume', '--dir', '--max-steps', '--permission-mode', '--allowed-tools'].every(flag => text.includes(flag))) {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix lacks the required streamed run and resume interface')
  }
  if (sha256(readBound(executable.path)) !== executable.sha256) throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix executable changed during its probe')
  return Object.freeze({
    ...executable, version: tuple.join('.'), provider: 'reasonix',
    runtimeIdentity: require('../../../scripts/harness-v2-native.cjs').runtimeDependencyIdentity(executable.path, options.env || process.env),
    portableRuntimeIdentity: require('../../../scripts/harness-v2-native.cjs').portableRuntimeDependencyIdentity('reasonix', executable.path, options.env || process.env),
    evidenceHashes: [sha256(String(version.stdout)), sha256(text)],
  })
}

// Copy model connection settings, never user hooks, plugins, agent prompts,
// permission overrides, or project config. Native Reasonix parses the emitted
// TOML itself; its model/provider semantics are preserved verbatim.
function connectionConfig(file) {
  const source = toml.parse(readBound(file).toString('utf8'))
  if (!Array.isArray(source.providers) || !source.providers.length) {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Configure a Reasonix model provider before activation')
  }
  const providers = source.providers.map(provider => {
    const selected = {}
    for (const key of [
      'name', 'kind', 'base_url', 'chat_url', 'request_url', 'model', 'models', 'default',
      'api_key_env', 'headers', 'extra_body', 'context_window', 'max_tokens',
      'max_output_tokens', 'responses_mode', 'reasoning_effort',
    ]) if (Object.hasOwn(provider, key)) selected[key] = provider[key]
    if (typeof selected.name !== 'string' || !selected.name) throw new ReasonixError('PROVIDER_UNSUPPORTED', 'A Reasonix provider has no name')
    if (Object.hasOwn(selected, 'max_output_tokens') && (!Number.isSafeInteger(selected.max_output_tokens) || selected.max_output_tokens <= 0)) {
      throw new ReasonixError('PROFILE_INVALID', 'Reasonix provider max_output_tokens must be a positive safe integer')
    }
    return selected
  })
  return { ...(source.default_model ? { default_model: source.default_model } : {}), providers }
}

function renderCredentials(connection, environment) {
  // v1.30 resolves provider keys from REASONIX_HOME/.env, not the inherited
  // process environment. Project only explicitly configured credential names;
  // never copy the caller's whole environment or an untrusted dotenv file.
  const names = [...new Set(connection.providers.map(provider => provider.api_key_env).filter(Boolean))].sort()
  return names.flatMap(name => {
    if (typeof name !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new ReasonixError('PROFILE_INVALID', 'Invalid configured credential name')
    if (!Object.hasOwn(environment, name) || environment[name] === '') return []
    const value = environment[name]
    if (typeof value !== 'string' || value.includes('\0') || Buffer.byteLength(value) > 65536) throw new ReasonixError('PROFILE_INVALID', 'Invalid configured credential value')
    // Match godotenv's quoted-value escaping, including its interpolation
    // metacharacters. Opaque credentials must not expand $OTHER_VARIABLE.
    const escaped = value.replace(/[\\"$`]/g, character => `\\${character}`).replace(/\n/g, '\\n').replace(/\r/g, '\\r')
    return [`${name}="${escaped}"\n`]
  }).join('')
}

// v1.30 can kill its direct stdio child when the native context ends, before
// closing that child's stdin. Keep the real controller server one pipe behind
// a byte-preserving relay: even SIGKILL of this relay closes the server's input
// and lets its existing lease/cancellation cleanup run. The server stays in
// the same owned process group; no detached child or alternative tool surface.
function runControlledStdioRelay(argv) {
  if (argv[0] !== '--controlled-stdio') throw new ReasonixError('TOOL_POLICY_INVALID', 'Expected the controlled stdio entry point')
  const serverPath = require.resolve('../../../scripts/harness-v2-tool-server.cjs')
  const prepared = require(serverPath).parseArguments(argv.slice(1))
  if (prepared.policy.provider !== 'reasonix') throw new ReasonixError('TOOL_POLICY_INVALID', 'Controlled stdio requires a Reasonix policy')
  const child = childProcess.spawn(process.execPath, [serverPath, ...argv.slice(1)], {
    env: process.env, stdio: ['pipe', 'pipe', 'inherit'], shell: false, detached: false,
  })
  let closing = false, parentSignal, failed = false, graceTimer, killTimer
  const close = signal => {
    if (signal) parentSignal ||= signal
    if (closing) return
    closing = true
    process.stdin.unpipe(child.stdin)
    process.stdin.pause()
    child.stdin.end()
    if (signal) child.kill(signal)
    graceTimer = setTimeout(() => child.kill('SIGTERM'), 1000)
    killTimer = setTimeout(() => child.kill('SIGKILL'), 3000)
    graceTimer.unref(); killTimer.unref()
  }
  const brokenPipe = error => { if (error.code !== 'EPIPE') failed = true; close() }
  const terminate = () => close('SIGTERM'), interrupt = () => close('SIGINT')
  process.once('SIGTERM', terminate); process.once('SIGINT', interrupt)
  process.stdin.once('end', () => close())
  process.stdin.on('error', brokenPipe); process.stdout.on('error', brokenPipe)
  child.stdin.on('error', brokenPipe); child.stdout.on('error', brokenPipe)
  child.once('error', () => { failed = true; close() })
  child.once('close', (code, signal) => {
    clearTimeout(graceTimer); clearTimeout(killTimer)
    process.stdin.unpipe(child.stdin); process.stdin.destroy()
    process.removeListener('SIGTERM', terminate); process.removeListener('SIGINT', interrupt)
    const terminalSignal = signal || parentSignal
    if (terminalSignal) process.kill(process.pid, terminalSignal)
    else process.exitCode = failed ? 1 : code ?? 1
  })
  process.stdin.pipe(child.stdin)
  child.stdout.pipe(process.stdout)
}

function renderConfig(options) {
  const { connection, systemPrompt, targetPath, scratchPath, readOnly } = options
  if (!connection || !Array.isArray(connection.providers) || !path.isAbsolute(targetPath) || !path.isAbsolute(scratchPath)) {
    throw new ReasonixError('PROFILE_INVALID', 'Native profile requires absolute target and scratch paths and a provider configuration')
  }
  // Load lazily: the boundary itself imports readBound/writePrivate from here.
  const controlled = options.toolBoundary ? require('../../../scripts/harness-v2-controlled-tools.cjs') : null
  const server = controlled?.serverSpec(options.toolBoundary, 'reasonix')
  const toolFree = options.toolBoundary?.policy.toolFree === true
  return toml.stringify({
    ...connection,
    agent: { system_prompt: systemPrompt, max_subagent_depth: 1, max_subagent_concurrency: 1, max_parallel_writers: 1 },
    skills: { disable_implicit_invocation: true, paths: [] },
    ...(server ? {
      // A nonempty native enabled list filters builtin registration. Empty
      // means ALL builtins in Reasonix, so never emit [] for controlled runs.
      // The pinned native registry treats a nonmatching, nonempty filter as
      // no builtins. An empty array would enable every builtin instead.
      tools: { enabled: toolFree ? ['autoprompt_no_tools'] : [CONTROLLED_PROXY, ...CONTROLLED_NATIVE_TOOLS] },
      plugins: toolFree ? [] : [{ name: CONTROLLED_SERVER, type: 'stdio', ...server,
        args: [__filename, '--controlled-stdio', ...server.args.slice(1)],
      }],
    } : {}),
    permissions: {
      mode: server ? 'deny' : 'allow',
      ...(server ? { allow: toolFree ? [] : [...CONTROLLED_TOOLS, ...CONTROLLED_NATIVE_TOOLS] } : {}),
      // Keep use_capability denied: a concrete call is authorized under its
      // resolved MCP name; list/inspect/decline and native targets gain no grant.
      deny: server ? toolFree ? [...CONTROLLED_DENIED_TOOLS, ...CONTROLLED_TOOLS, ...CONTROLLED_NATIVE_TOOLS] : CONTROLLED_DENIED_TOOLS.filter(name => !CONTROLLED_NATIVE_TOOLS.includes(name)) : [...FORBIDDEN_TOOLS, ...(readOnly && !options.checkerScratch ? ['write_file', 'edit_file', 'apply_patch'] : [])],
      allow_dynamic_bash: false,
    },
    sandbox: { workspace_root: readOnly ? scratchPath : targetPath, allow_write: [...(readOnly ? [] : [scratchPath]), ...(options.writableRoots || [])], bash: 'enforce', network: false },
    telemetry: { cli_metrics: 'off' },
    secrets: { filter_subprocess_env: true },
  })
}

function parseTerminal(text) {
  const decode = value => {
    const result = JSON.parse(value)
    if (!result || typeof result !== 'object' || Array.isArray(result)) throw new Error('not an object')
    return result
  }
  try { return decode(text) } catch {}
  // The native terminal may present its one result in a labelled JSON block.
  // Ignore presentation only; competing JSON/fences stay ambiguous and fail.
  // The adapter still validates the full schema and authenticated receipts.
  const block = typeof text === 'string' && /^(.*?)```json\s*\n([\s\S]*?)\n```(.*?)$/isu.exec(text)
  if (block && !/[{}\[\]]|```/u.test(`${block[1]}${block[3]}`)) {
    try { return decode(block[2].trim()) } catch {}
  }
  throw new ReasonixError('CHILD_RESULT_INVALID', 'Reasonix must return one JSON object matching the assigned result schema')
}

function nativeUsage(usage) {
  const input = usage.promptTokens
  const cached = usage.cacheHitTokens
  const output = usage.completionTokens
  const reasoning = usage.reasoningTokens || 0
  if (usage.estimated === true || ![input, cached, output, reasoning].every(value => Number.isSafeInteger(value) && value >= 0) || cached > input || reasoning > output) {
    throw new ReasonixError('PROVIDER_USAGE_UNKNOWN', 'Reasonix returned missing, estimated, or inconsistent token accounting')
  }
  return { noncachedInput: input - cached, cachedInput: cached, output, reasoning }
}

module.exports = { CONTROLLED_CAPABILITIES, CONTROLLED_DENIED_TOOLS, CONTROLLED_NATIVE_TOOLS, CONTROLLED_PROXY, CONTROLLED_SERVER, CONTROLLED_TOOLS, FORBIDDEN_TOOLS, MINIMUM_VERSION, ReasonixError, connectionConfig, inside, locateExecutable, nativeUsage, parseTerminal, privateDirectory, probeExecutable, readBound, renderConfig, renderCredentials, sha256, validateNativeTodoWrite, writePrivate }

if (require.main === module) {
  try { runControlledStdioRelay(process.argv.slice(2)) } catch (error) {
    process.stderr.write(`${error.code || 'TOOL_SERVER_FAILED'}: Controlled Reasonix stdio could not start\n`)
    process.exitCode = 1
  }
}

'use strict'

// Retire complete receipt-owned paths before deleting bytes. The single journal
// rename is the commit point: interrupted publication rolls back, interrupted
// post-commit cleanup resumes without corrupting a live package.
const fs = require('node:fs')
const path = require('node:path')
const crypto = require('node:crypto')
const { RootGuard } = require('../../../scripts/install/operation-lock.cjs')
const { ReasonixError, privateDirectory, readBound, sha256, writePrivate } = require('./native.js')
const RECEIPT = '.autoprompt-reasonix-v2.json'
const ENTRY = 'skills/autoprompt/SKILL.md'
const HASH = /^[a-f0-9]{64}$/
const GENERATION = /^reasonix-v2\.0\.0-[a-f0-9]{16}$/
const NAME = /^reasonix-remove-[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/
const object = value => value !== null && typeof value === 'object' && !Array.isArray(value)
const exists = file => { try { fs.lstatSync(file); return true } catch (error) { if (error.code === 'ENOENT') return false; throw error } }
function fail(message) { throw new ReasonixError('INSTALL_RECOVERY_REQUIRED', message) }
function relative(file) {
  return typeof file === 'string' && file && !/[\\:\0\r\n]/.test(file) && !path.isAbsolute(file) &&
    file.split('/').every(part => part && part !== '.' && part !== '..')
}
function allowedDirectories(files) {
  const result = new Set([''])
  for (const file of Object.keys(files)) {
    const parts = file.split('/'); parts.pop()
    while (parts.length) { result.add(parts.join('/')); parts.pop() }
  }
  return result
}
function checkTree(guard, root, files, partial = false) {
  const directories = allowedDirectories(files), seen = new Set()
  function visit(directory, prefix = '') {
    guard.assertExisting(directory, 'directory')
    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
      const name = prefix ? `${prefix}/${entry.name}` : entry.name
      const file = path.join(directory, entry.name)
      if (entry.isDirectory() && !entry.isSymbolicLink()) {
        if (!directories.has(name)) fail(`Unowned removal directory retained: ${file}`)
        visit(file, name)
      } else {
        if (!Object.hasOwn(files, name) || sha256(readBound(guard.assertExisting(file))) !== files[name]) fail(`Changed or unowned removal file retained: ${file}`)
        seen.add(name)
      }
    }
  }
  visit(root)
  if (!partial && seen.size !== Object.keys(files).length) fail(`Removal inventory is incomplete: ${root}`)
}
function checkItem(guard, file, move, partial = false) {
  if (move.kind === 'directory') checkTree(guard, file, move.files, partial)
  else if (sha256(readBound(guard.assertExisting(file))) !== move.sha256) fail(`Changed removal file retained: ${file}`)
}
function emptyDirectories(guard, root) {
  guard.assertExisting(root, 'directory')
  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
    if (!entry.isDirectory() || entry.isSymbolicLink()) fail(`Unexpected removal entry retained: ${path.join(root, entry.name)}`)
    emptyDirectories(guard, path.join(root, entry.name))
  }
  fs.rmdirSync(root)
}
function validate(guard, journal) {
  if (!object(journal) || journal.schemaVersion !== 1 || journal.provider !== 'reasonix' || journal.root !== guard.rootReal ||
      !GENERATION.test(journal.generation || '') || !Array.isArray(journal.moves) || ![1, 3].includes(journal.moves.length)) fail('Invalid Reasonix removal journal')
  const expected = [[`.autoprompt-private/bundles/${journal.generation}`, 'bundle', 'directory'], [ENTRY, 'entry', 'file'], [RECEIPT, 'receipt', 'file']]
  journal.moves.forEach((move, index) => {
    if (!object(move) || move.from !== expected[index][0] || move.to !== expected[index][1] || move.kind !== expected[index][2]) fail('Removal journal targets an unowned path')
    if (move.kind === 'file') { if (!HASH.test(move.sha256 || '')) fail('Invalid removal file hash') }
    else if (!object(move.files) || !Object.keys(move.files).length || !Object.hasOwn(move.files, 'package.json') ||
      Object.entries(move.files).some(([file, hash]) => !relative(file) || !HASH.test(hash))) fail('Invalid removal inventory')
  })
  return journal
}
function inspectTransaction(guard, directory, journal) {
  const allowed = new Set(['prepared.json', 'committed.json', ...journal.moves.map(move => move.to)])
  for (const entry of fs.readdirSync(guard.assertExisting(directory, 'directory'))) {
    if (!allowed.has(entry)) fail(`Unowned transaction entry retained: ${path.join(directory, entry)}`)
  }
}
function rollback(guard, directory, journal) {
  inspectTransaction(guard, directory, journal)
  for (const move of [...journal.moves].reverse()) {
    const from = path.join(guard.root, move.from), retained = path.join(directory, move.to)
    if (exists(retained)) {
      checkItem(guard, retained, move)
      if (exists(from)) fail(`Cannot restore over a new file: ${from}`)
      privateDirectory(path.dirname(from)); guard.assertParent(from)
      fs.renameSync(retained, from)
    } else {
      if (!exists(from)) fail(`Removal recovery lost both copies: ${from}`)
      checkItem(guard, from, move)
    }
  }
  fs.unlinkSync(guard.assertExisting(path.join(directory, 'prepared.json')))
  fs.rmdirSync(directory)
}
function cleanup(guard, directory, journal) {
  inspectTransaction(guard, directory, journal)
  // Validate every remaining byte before deleting any; missing bytes are allowed
  // only after the durable commit because cleanup may already have progressed.
  for (const move of journal.moves) {
    const file = path.join(directory, move.to)
    if (exists(file)) checkItem(guard, file, move, true)
  }
  for (const move of journal.moves) {
    const retained = path.join(directory, move.to)
    if (!exists(retained)) continue
    if (move.kind === 'directory') {
      for (const [name, hash] of Object.entries(move.files)) {
        const file = path.join(retained, name)
        if (!exists(file)) continue
        if (sha256(readBound(guard.assertExisting(file))) !== hash) fail(`Removal file changed during cleanup: ${file}`)
        fs.unlinkSync(file)
      }
      emptyDirectories(guard, retained)
    } else fs.unlinkSync(guard.assertExisting(retained))
  }
  fs.unlinkSync(guard.assertExisting(path.join(directory, 'committed.json')))
  fs.rmdirSync(directory)
}
function recover(root) {
  const guard = new RootGuard(root), parent = path.join(root, '.autoprompt-private', 'transactions')
  if (!exists(parent)) return 0
  guard.assertExisting(parent, 'directory')
  let recovered = 0
  for (const name of fs.readdirSync(parent).filter(name => name.startsWith('reasonix-remove-'))) {
    if (!NAME.test(name)) fail(`Unknown Reasonix removal transaction retained: ${name}`)
    const directory = path.join(parent, name)
    guard.assertExisting(directory, 'directory')
    if (!fs.readdirSync(directory).length) { fs.rmdirSync(directory); recovered++; continue }
    const prepared = path.join(directory, 'prepared.json'), committed = path.join(directory, 'committed.json')
    if (exists(prepared) === exists(committed)) fail(`Removal journal needs manual recovery: ${directory}`)
    const journal = validate(guard, JSON.parse(readBound(guard.assertExisting(exists(committed) ? committed : prepared))))
    if (exists(committed)) cleanup(guard, directory, journal)
    else rollback(guard, directory, journal)
    recovered++
  }
  return recovered
}
function retire(installed, { includePublic = false } = {}) {
  const guard = new RootGuard(installed.root)
  const moves = [{ from: `.autoprompt-private/bundles/${installed.payloadGeneration}`, to: 'bundle', kind: 'directory',
    files: { ...installed.files, 'package.json': sha256(readBound(guard.assertExisting(path.join(installed.bundle, 'package.json')))) } }]
  if (includePublic) for (const [from, to] of [[ENTRY, 'entry'], [RECEIPT, 'receipt']]) {
    moves.push({ from, to, kind: 'file', sha256: sha256(readBound(guard.assertExisting(path.join(installed.root, from)))) })
  }
  const journal = validate(guard, { schemaVersion: 1, provider: 'reasonix', root: guard.rootReal, generation: installed.payloadGeneration, moves })
  for (const move of moves) checkItem(guard, path.join(installed.root, move.from), move)
  const directory = path.join(installed.root, '.autoprompt-private', 'transactions', `reasonix-remove-${crypto.randomUUID()}`)
  privateDirectory(directory)
  writePrivate(path.join(directory, 'prepared.json'), `${JSON.stringify(journal)}\n`)
  try {
    for (const move of moves) {
      const from = path.join(installed.root, move.from), to = path.join(directory, move.to)
      checkItem(guard, from, move); guard.assertParent(to)
      if (exists(to)) fail(`Removal destination already exists: ${to}`)
      fs.renameSync(from, to)
    }
    fs.renameSync(path.join(directory, 'prepared.json'), path.join(directory, 'committed.json'))
  } catch (error) {
    try { rollback(guard, directory, journal) }
    catch (rollbackError) { throw new ReasonixError('INSTALL_RECOVERY_REQUIRED', `${error.message}; removal rollback requires recovery: ${rollbackError.message}`, { recoveryPath: directory }) }
    throw error
  }
  try { cleanup(guard, directory, journal) }
  catch (error) {
    throw new ReasonixError('INSTALL_CLEANUP_REQUIRED', `Removal committed; retry the lifecycle command to finish private cleanup: ${error.message}`, { operationCommitted: true, recoveryPath: directory })
  }
}
module.exports = { recover, retire }

'use strict'

const fs = require('node:fs')
const path = require('node:path')
const {
  CONTROLLED_CAPABILITIES, CONTROLLED_NATIVE_TOOLS, CONTROLLED_PROXY, CONTROLLED_SERVER, CONTROLLED_TOOLS, ReasonixError, inside, nativeUsage, parseTerminal, privateDirectory, readBound, renderConfig, renderCredentials, sha256, validateNativeTodoWrite, writePrivate,
} = require('./native.js')
const core = require('../../codex/workflow/phase-budget.js')
const { validateJsonSchema } = require('../../codex/workflow/json-schema-validator.js')
const { nativeOutcomeDescriptionProjection } = require('../../../scripts/harness-v2-native-wire-projection.cjs')
const { createQuotaRelay } = require('../../../scripts/harness-v2-quota-relay.cjs')
const { TOOLS, canonicalJson } = require('../../../scripts/harness-v2-tool-boundary.cjs')

function controlledInvocation(name, args) {
  const index = CONTROLLED_CAPABILITIES.indexOf(args.capability_id)
  if (name !== CONTROLLED_PROXY || args.action !== 'call' || index === -1 ||
      Object.keys(args).some(key => !['action', 'capability_id', 'arguments', 'reason'].includes(key)) ||
      (Object.hasOwn(args, 'reason') && typeof args.reason !== 'string') ||
      !args.arguments || typeof args.arguments !== 'object' || Array.isArray(args.arguments)) {
    throw new ReasonixError('ROLE_POLICY_DENIED', 'Only exact calls to the six controller-owned MCP capabilities are permitted')
  }
  // Native v1.30 advertises optional reason metadata. Its call action forwards
  // only arguments; preserve that distinction rather than treating metadata
  // as an executable input or admitting other native capability actions.
  return { name: CONTROLLED_TOOLS[index], args: args.arguments }
}

function missingCapabilityAction(name, args) {
  return name === CONTROLLED_PROXY && !Object.hasOwn(args, 'action') &&
    CONTROLLED_CAPABILITIES.includes(args.capability_id) &&
    Object.keys(args).every(key => ['capability_id', 'arguments', 'reason'].includes(key)) &&
    (!Object.hasOwn(args, 'reason') || typeof args.reason === 'string') &&
    args.arguments && typeof args.arguments === 'object' && !Array.isArray(args.arguments)
}
const MISSING_ACTION_ERROR = 'unknown action ""; use list, inspect, call, or decline'

// A malformed spelling of one of our six IDs is rejected by native v1.30
// before resolution. Preserve that exact error for a bounded model correction;
// never rewrite the identifier or execute its intended target.
function nativeArgumentRejectionError(name, args) {
  if (missingCapabilityAction(name, args)) return MISSING_ACTION_ERROR
  if (name === CONTROLLED_PROXY && args.action === 'call' &&
      CONTROLLED_CAPABILITIES.some(id => id.replace('/', ':') === args.capability_id) &&
      Object.keys(args).every(key => ['action', 'capability_id', 'arguments', 'reason'].includes(key)) &&
      (!Object.hasOwn(args, 'reason') || typeof args.reason === 'string') &&
      args.arguments && typeof args.arguments === 'object' && !Array.isArray(args.arguments)) {
    return `invalid mcp-tool id ${JSON.stringify(args.capability_id)}; want mcp-tool:<server>/<tool>`
  }
  return null
}

// Reasonix v1.30 presents MCP tools through one generic use_capability
// function. Its provider-visible schema permits discovery and does not require
// this controller's call-envelope fields. Project the narrower contract in a
// JSON-tool-calling form; controlledInvocation remains the execution boundary.
function controlledToolProtocolProjection(targetPath, scratchPath) {
  const variants = TOOLS.map(tool => ({
    type: 'object', additionalProperties: false,
    required: ['action', 'capability_id', 'arguments'],
    properties: {
      action: { const: 'call' },
      capability_id: { const: `mcp-tool:${CONTROLLED_SERVER}/${tool.name}` },
      arguments: tool.inputSchema,
      reason: { type: 'string' },
    },
  }))
  const examples = {
    read: { action: 'call', capability_id: `mcp-tool:${CONTROLLED_SERVER}/read`, arguments: { path: targetPath, startLine: 1, lineCount: 200 } },
    list: { action: 'call', capability_id: `mcp-tool:${CONTROLLED_SERVER}/list`, arguments: { path: targetPath } },
    search: { action: 'call', capability_id: `mcp-tool:${CONTROLLED_SERVER}/search`, arguments: { path: targetPath, text: 'needle', maxResults: 20 } },
    write: { action: 'call', capability_id: `mcp-tool:${CONTROLLED_SERVER}/write`, arguments: { path: path.join(scratchPath, 'note.txt'), content: 'note' } },
    edit: { action: 'call', capability_id: `mcp-tool:${CONTROLLED_SERVER}/edit`, arguments: { path: path.join(scratchPath, 'note.txt'), oldText: 'old', newText: 'new', replaceAll: false } },
    bash: { action: 'call', capability_id: `mcp-tool:${CONTROLLED_SERVER}/bash`, arguments: { command: 'pwd', cwd: targetPath, timeoutMs: 300000 } },
  }
  return [
    'REQUIRED use_capability WIRE CONTRACT: every use_capability call must be one complete JSON value accepted by this closed schema. action, capability_id, and arguments are all required. action must literally be "call". Never omit action; never use action "list", "inspect", or "decline"; never invent a catalog capability_id.',
    JSON.stringify({ oneOf: variants }),
    'Canonical valid call shapes (choose the matching operation and replace only its allowed arguments):',
    JSON.stringify(examples),
  ]
}

function controlledOutput(tool) {
  if (!tool.err) return tool.output
  // Native v1.30 wraps an MCP isError result twice. Accept only its exact
  // envelope, then verify the unchanged inner result against the private
  // journal. Never search for a JSON-looking substring or discard suffixes.
  const prefix = 'plugin tool reported error: '
  if (typeof tool.err !== 'string' || !tool.err.startsWith(prefix)) {
    throw new ReasonixError('TOOL_OUTPUT_INCOMPLETE', 'Native failure has no complete controller result')
  }
  const output = tool.err.slice(prefix.length)
  if (tool.output !== `error: ${tool.err}\n${output}`) {
    throw new ReasonixError('TOOL_OUTPUT_INCOMPLETE', 'Native failure changed the controller result envelope')
  }
  return output
}
function nativeTodoAcknowledgement(args, tool) {
  if (tool.readOnly !== true) throw new ReasonixError('ROLE_POLICY_DENIED', 'Reasonix native todo_write must remain read-only')
  const output = typeof tool.output === 'string' ? tool.output : ''
  if (Buffer.byteLength(output) > 4096) throw new ReasonixError('TOOL_OUTPUT_INCOMPLETE', 'Reasonix native todo_write acknowledgement is oversized')
  if (tool.err) return { output, failed: true }
  const match = /^Todos updated: (\d+) total — (\d+) completed, (\d+) in progress, (\d+) pending\.$/.exec(output)
  if (!match) throw new ReasonixError('TOOL_OUTPUT_INCOMPLETE', 'Reasonix native todo_write acknowledgement is invalid')
  const expected = [args.todos.length, args.todos.filter(todo => todo.status === 'completed').length, args.todos.filter(todo => todo.status === 'in_progress').length, args.todos.filter(todo => todo.status === 'pending').length]
  if (match.slice(1).some((value, index) => Number(value) !== expected[index])) throw new ReasonixError('TOOL_OUTPUT_INCOMPLETE', 'Reasonix native todo_write acknowledgement differs from dispatched todos')
  return { output, failed: false }
}

// Reasonix's reviewed OpenAI provider route is exactly base_url followed by
// /chat/completions.  A reservation-private connection may not retain a
// request/chat override or a second provider that could evade the relay.
function reasonixQuotaConnection(connection, record) {
  const requested = record.assignment?.model || connection.default_model
  if (typeof requested !== 'string' || !requested || !Array.isArray(connection.providers)) {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix quota execution requires one explicit selected provider model')
  }
  const modelNames = provider => [provider.model, ...(Array.isArray(provider.models) ? provider.models : [])]
    .filter(value => typeof value === 'string')
  const providers = connection.providers.filter(provider => provider && typeof provider === 'object' && typeof provider.name === 'string')
  // Mirror v1.30 Config.ResolveModel: first a provider/model reference, then
  // a provider name, then the complete requested string as a model. Model
  // IDs such as z-ai/glm-5.3-flash therefore remain valid under a provider
  // named openrouter; a slash alone is not evidence of a provider prefix.
  const slash = requested.indexOf('/')
  const providerModel = slash > 0
    ? providers.filter(provider => provider.name === requested.slice(0, slash) && modelNames(provider).includes(requested.slice(slash + 1)))
    : []
  const namedProvider = providerModel.length ? [] : providers.filter(provider => provider.name === requested)
  const bareModel = providerModel.length || namedProvider.length ? [] : providers.filter(provider => modelNames(provider).includes(requested))
  const selected = providerModel.length ? providerModel : namedProvider.length ? namedProvider : bareModel
  if (selected.length !== 1) {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix quota execution could not resolve one configured provider')
  }
  const provider = selected[0]
  if (provider.kind !== 'openai' || typeof provider.base_url !== 'string' || !provider.base_url ||
      Object.hasOwn(provider, 'chat_url') || Object.hasOwn(provider, 'request_url')) {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix quota execution requires an OpenAI base_url without route overrides')
  }
  let upstream
  try { upstream = new URL(provider.base_url) } catch { throw new ReasonixError('PROFILE_INVALID', 'Reasonix quota upstream URL is invalid') }
  if (!['http:', 'https:'].includes(upstream.protocol) || upstream.username || upstream.password || upstream.search || upstream.hash) {
    throw new ReasonixError('PROFILE_INVALID', 'Reasonix quota upstream must be one explicit HTTP base URL')
  }
  const extraBody = provider.extra_body
  if (extraBody !== undefined && (!extraBody || typeof extraBody !== 'object' || Array.isArray(extraBody) ||
      Object.hasOwn(extraBody, 'max_tokens') || Object.hasOwn(extraBody, 'max_completion_tokens') ||
      Object.hasOwn(extraBody, 'max_output_tokens'))) {
    throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix quota execution cannot accept an alternate native output-cap field')
  }
  const configuredOutputCap = provider.max_output_tokens
  const initialOutputCap = Math.min(record.providerTokenLimit,
    Number.isSafeInteger(configuredOutputCap) && configuredOutputCap > 0 ? configuredOutputCap : 4096)
  return Object.freeze({
    upstreamBaseUrl: provider.base_url,
    protocol: 'chat-completions',
    project(baseUrl) {
      // v1.30 only emits a Chat Completions output cap when its provider
      // provider's top-level max_output_tokens.  Supply the host allowance as
      // that initial cap; the loopback relay lowers it before admission and
      // forwarding based on this exact request's bounded input.
      return {
        default_model: requested,
        providers: [{ ...provider, base_url: baseUrl, max_output_tokens: initialOutputCap, ...(extraBody ? { extra_body: extraBody } : {}) }],
      }
    },
  })
}

function verifyControlledReceipt(verifier, ...args) {
  // The real server may append the next completed call while the native
  // observer reads the journal. Retry only a refused unstable snapshot; every
  // attempt still runs the unchanged policy, chain, argument and result checks.
  // Truncated, mismatched, replayed or persistently changing data still fails.
  for (let attempt = 0; attempt < 3; attempt++) {
    try { return verifier.verify(...args) } catch (error) {
      if (attempt === 2 || error.code !== 'PAYLOAD_INVALID' || error.message !== 'File changed while reading') throw error
    }
  }
}

// Normalize the native wire protocol at the provider boundary. The reviewed
// controller continues to own result schemas, checks, accounting, and recovery.
class ReasonixEventStream {
  constructor(record = {}) {
    this.record = record
    // This accumulator sees only normalized, receipt-verified transport
    // events. The core uses this private context bit to reject lookalike raw
    // native fields that try to erase command evidence.
    this.accumulator = core.createCodexJsonlAccumulator({ ...record, controllerAuthenticatedNativeProjection: true })
    this.hash = require('node:crypto').createHash('sha256')
    this.usage = { noncachedInput: 0, cachedInput: 0, output: 0, reasoning: 0 }
    this.activeTools = new Set()
    this.toolDispatches = new Map()
    this.completedTools = new Set()
    this.receiptVerifier = record.toolBoundary
      ? new (require('../../../scripts/harness-v2-controlled-tools.cjs').ReceiptVerifier)('reasonix', record.toolBoundary) : null
    this.result = null
    this.sawUsage = false
    this.pendingToolObservations = []
    this.toolCount = record.priorToolCallCount || 0
    this.nativeArgumentRejections = 0
  }

  emit(event) { this.accumulator.push(JSON.stringify(event)) }

  push(line) {
    if (Buffer.byteLength(line) > 8 * 1024 * 1024) throw new ReasonixError('TRANSPORT_LIMIT_EXCEEDED', 'Reasonix event exceeds the capture limit')
    let event
    try { event = JSON.parse(line) } catch { throw new ReasonixError('TRANSPORT_INVALID', 'Reasonix emitted invalid JSON') }
    if (!event || typeof event !== 'object' || Array.isArray(event)) throw new ReasonixError('TRANSPORT_INVALID', 'Reasonix event must be an object')
    this.hash.update(`${line}\n`)
    this.record.onTransportActivity?.()
    this.record.onEvent?.(event, line)
    if (this.result) throw new ReasonixError('TRANSPORT_INVALID', 'Reasonix emitted data after its terminal result')
    if (event.kind === 'usage') {
      const delta = nativeUsage(event.usage || {})
      for (const key of Object.keys(this.usage)) {
        this.usage[key] += delta[key]
        if (!Number.isSafeInteger(this.usage[key])) throw new ReasonixError('PROVIDER_USAGE_UNKNOWN', 'Native token total exceeds exact integer accounting')
      }
      this.sawUsage = true
      if (typeof this.record.onUsageDelta === 'function') {
        const verdict = this.record.onUsageDelta(delta, { ...this.usage })
        if (!verdict || verdict.continue !== true) {
          const error = new ReasonixError('BUDGET_EXHAUSTED', 'Scheduler denied continued Reasonix token usage')
          error.usage = { ...this.usage }
          throw error
        }
      }
    }
    if (event.kind === 'tool_dispatch' || event.kind === 'tool_result') {
      if (this.record.providerToolCallLimit === 0) throw new ReasonixError('ROLE_POLICY_DENIED', 'The assigned role does not permit tool calls')
      const tool = event.tool || {}
      if (typeof tool.id !== 'string' || !tool.id) throw new ReasonixError('TRANSPORT_INVALID', 'Reasonix tool event has no identity')
      if (tool.name === 'todo_write' && (tool.readOnly !== true || tool.resolvedName !== undefined || tool.capabilityId !== undefined)) throw new ReasonixError('ROLE_POLICY_DENIED', 'Reasonix native todo_write identity is invalid')
      if (event.kind === 'tool_dispatch' && tool.partial === true) {
        if (this.receiptVerifier && tool.name !== CONTROLLED_PROXY && tool.name !== 'todo_write') throw new ReasonixError('ROLE_POLICY_DENIED', 'Native builtins and direct tool dispatch are disabled')
        return event
      }
      const refreshed = event.kind === 'tool_dispatch' && tool.refreshed === true
      if (refreshed && !this.receiptVerifier) return event
      const start = event.kind === 'tool_dispatch' && !refreshed
      let args
      try { args = JSON.parse(tool.args || '{}') } catch { throw new ReasonixError('TRANSPORT_INVALID', 'Native tool arguments are invalid') }
      if (!args || typeof args !== 'object' || Array.isArray(args)) throw new ReasonixError('TRANSPORT_INVALID', 'Native tool arguments must be an object')
      if (start) {
        if (this.activeTools.has(tool.id) || this.completedTools.has(tool.id)) throw new ReasonixError('TRANSPORT_INVALID', 'Duplicate native tool dispatch')
        const nativeTodo = tool.name === 'todo_write'
        if (nativeTodo) validateNativeTodoWrite(args)
        const argumentRejection = this.receiptVerifier && nativeArgumentRejectionError(tool.name, args)
        // A native assistant can issue a parallel batch before receiving any
        // argument feedback. Allow that batch and a correction batch, while
        // retaining a finite call limit and exact non-execution acknowledgments.
        if (argumentRejection && ++this.nativeArgumentRejections > 8) throw new ReasonixError('ROLE_POLICY_DENIED', 'Reasonix exhausted its native argument corrections')
        const invocation = nativeTodo ? { kind: 'nativeTodo', name: tool.name, args }
          : argumentRejection ? { kind: 'nativeArgumentRejection', name: tool.name, args, expectedError: argumentRejection }
            : this.receiptVerifier ? controlledInvocation(tool.name, args) : { name: tool.name, args }
        this.activeTools.add(tool.id)
        this.toolDispatches.set(tool.id, { name: tool.name, args, invocation })
        const attemptedCount = ++this.toolCount
        if (!Number.isSafeInteger(attemptedCount) || attemptedCount < 1) throw new ReasonixError('TRANSPORT_LIMIT_EXCEEDED', 'Reasonix tool count overflowed')
        const evidence = { attemptedCount, continuationId: this.record.continuationId || null, itemIdHash: sha256(tool.id), itemType: tool.name, observedPhase: 'started' }
        if (evidence.continuationId) this.record.onToolCallObserved?.(evidence)
        else this.pendingToolObservations.push(evidence)
        if (attemptedCount > core.codexChildToolCallLimit(this.record)) throw new ReasonixError('CHILD_TOOL_CALL_LIMIT_EXHAUSTED', 'Reasonix child exceeded its transport-enforced tool-call limit')
      } else if (!this.activeTools.has(tool.id)) {
        throw new ReasonixError('TRANSPORT_INVALID', 'Native tool result has no matching dispatch')
      }
      const dispatched = this.toolDispatches.get(tool.id)
      if (!start && (dispatched.name !== tool.name ||
          canonicalJson(dispatched.args) !== canonicalJson(args))) {
        throw new ReasonixError('TRANSPORT_INVALID', 'Native tool result changed the dispatched identity or arguments')
      }
      const invocation = dispatched.invocation
      const nativeTodo = invocation.kind === 'nativeTodo'
      const nativeArgumentRejection = invocation.kind === 'nativeArgumentRejection'
      // v1.30 rejects these exact malformed arguments before any target or
      // execution exists. Observe only that exact failed native attempt so the
      // model can supply the required argument; never infer or execute "call".
      if (nativeArgumentRejection && (tool.readOnly !== true ||
          tool.resolvedName !== undefined || tool.capabilityId !== undefined || tool.execution !== undefined)) {
        throw new ReasonixError('ROLE_POLICY_DENIED', 'Reasonix argument rejection unexpectedly resolved an executable target')
      }
      if (this.receiptVerifier && !nativeTodo && !nativeArgumentRejection &&
          (tool.resolvedName !== undefined && tool.resolvedName !== invocation.name ||
           tool.capabilityId !== undefined && tool.capabilityId !== dispatched.args.capability_id)) {
        throw new ReasonixError('TRANSPORT_INVALID', 'Native capability resolution changed the controller-owned target')
      }
      if (refreshed) return event
      const name = nativeTodo || nativeArgumentRejection ? invocation.name : this.receiptVerifier ? invocation.name.slice(`mcp__${CONTROLLED_SERVER}__`.length) : invocation.name
      const shell = name === 'bash'
      let output = tool.output || '', exitCode = tool.execution?.exitCode, failed = Boolean(tool.err)
      let preExecutionDenied = false
      if (!start) {
        if (tool.truncated === true || tool.background === true) throw new ReasonixError('TOOL_OUTPUT_INCOMPLETE', 'Native tool output was truncated or detached')
        if (nativeArgumentRejection) {
          if (tool.err !== invocation.expectedError || output !== `error: ${invocation.expectedError}`) {
            throw new ReasonixError('TOOL_OUTPUT_INCOMPLETE', 'Reasonix malformed-argument attempt lacks its exact native rejection')
          }
        } else if (nativeTodo) {
          const acknowledged = nativeTodoAcknowledgement(invocation.args, tool)
          output = acknowledged.output; failed = acknowledged.failed
        } else if (this.receiptVerifier) {
          const verified = verifyControlledReceipt(this.receiptVerifier, invocation.name, invocation.args, controlledOutput(tool), failed)
          if (shell && verified.command !== invocation.args.command) throw new ReasonixError('TOOL_RECEIPT_INVALID', 'Controlled command changed after dispatch')
          output = verified.output; exitCode = verified.exitCode; failed = verified.status === 'failed'
          preExecutionDenied = verified.executionState === 'NOT_STARTED'
        }
        if (shell && !preExecutionDenied && (!failed || this.receiptVerifier) && !Number.isSafeInteger(exitCode)) throw new ReasonixError('TOOL_OUTPUT_INCOMPLETE', 'Native command must finish in the foreground with complete captured output')
        if (preExecutionDenied && (!shell || !failed || exitCode !== null)) throw new ReasonixError('TOOL_RECEIPT_INVALID', 'Reasonix no-spawn command disposition is inconsistent')
        this.completedTools.add(tool.id)
        this.activeTools.delete(tool.id)
        this.toolDispatches.delete(tool.id)
      }
      const write = nativeTodo || nativeArgumentRejection ? false : this.receiptVerifier ? ['write', 'edit'].includes(name) : !tool.readOnly
      const item = {
        id: tool.id, type: shell ? 'command_execution' : write ? 'file_change' : 'mcp_tool_call',
        status: start ? 'in_progress' : failed ? 'failed' : 'completed',
        ...(shell ? {
          command: invocation.args.command || '',
          ...(preExecutionDenied ? { exit_code: null, controllerReceiptDisposition: 'NOT_STARTED', preExecutionDenied: true }
            : Number.isSafeInteger(exitCode) ? { exit_code: exitCode } : {}),
          aggregated_output: output,
        } : {}),
      }
      this.emit({ type: start ? 'item.started' : preExecutionDenied ? 'item.failed' : 'item.completed', item })
      if (!start && write && !failed && !this.record.readOnly) this.record.onFirstProductSignal?.({ kind: 'PRODUCT_EDIT', evidenceHash: sha256(line) })
    }
    if (event.type === 'result') {
      if (this.activeTools.size || !this.sawUsage || event.is_error || event.subtype !== 'success') {
        throw new ReasonixError('CHILD_RUNTIME_FAILURE', 'Reasonix did not finish with settled tools, exact usage, and a successful terminal result', { subtype: event.subtype, activeTools: this.activeTools.size })
      }
      if (typeof event.session_id !== 'string' || !event.session_id) throw new ReasonixError('SESSION_ID_MISSING', 'Reasonix terminal result has no session identity')
      if (this.record.continuationId && this.record.continuationId !== event.session_id) throw new ReasonixError('SESSION_ID_MISMATCH', 'Reasonix resumed a different session')
      const finalUsage = event.usage
      if (!finalUsage || finalUsage.input_tokens !== this.usage.noncachedInput + this.usage.cachedInput || finalUsage.output_tokens !== this.usage.output || finalUsage.cache_read_input_tokens !== this.usage.cachedInput) throw new ReasonixError('PROVIDER_USAGE_UNKNOWN', 'Native final usage differs from the observed request ledger')
      const output = parseTerminal(event.result)
      this.emit({ type: 'thread.started', thread_id: event.session_id })
      this.record.onSessionIdentified?.(event.session_id, { event, raw: line, occurredAt: new Date().toISOString() })
      for (const evidence of this.pendingToolObservations.splice(0)) this.record.onToolCallObserved?.({ ...evidence, continuationId: event.session_id })
      this.emit({ type: 'item.completed', item: { id: 'reasonix-terminal', type: 'agent_message', text: JSON.stringify(output) } })
      this.emit({ type: 'turn.completed', usage: {
        input_tokens: this.usage.noncachedInput + this.usage.cachedInput,
        cached_input_tokens: this.usage.cachedInput,
        output_tokens: this.usage.output, reasoning_output_tokens: this.usage.reasoning,
      } })
      this.result = output
    }
    return event
  }

  finish() {
    if (!this.result) throw new ReasonixError('CHILD_RESULT_MISSING', 'Reasonix exited without its structured terminal result')
    return { ...this.accumulator.snapshot(), rawOutputHash: this.hash.digest('hex'),
      ...(this.receiptVerifier ? { toolReceiptHashes: this.receiptVerifier.finish() } : {}) }
  }
}

function nativeContextRoot(nativeRoot, record, targetPath) {
  if (!record.continuationId) return path.join(nativeRoot, sha256(record.sessionId))
  const saved = JSON.parse(readBound(path.join(nativeRoot, 'contexts', `${sha256(record.continuationId)}.json`)))
  if (saved.sessionId !== record.continuationId || saved.providerRole !== record.providerRole ||
      saved.targetPath !== targetPath || !/^[a-f0-9]{64}$/.test(saved.rootKey || '')) {
    throw new ReasonixError('SESSION_ID_MISMATCH', 'Continuation differs from its original native role or workspace')
  }
  return path.join(nativeRoot, saved.rootKey)
}

function persistNativeContext(nativeRoot, sessionRoot, record, targetPath, sessionId) {
  const file = path.join(nativeRoot, 'contexts', `${sha256(sessionId)}.json`)
  const saved = { sessionId, providerRole: record.providerRole, targetPath, rootKey: path.basename(sessionRoot) }
  if (fs.existsSync(file)) {
    if (JSON.stringify(JSON.parse(readBound(file))) !== JSON.stringify(saved)) throw new ReasonixError('SESSION_ID_MISMATCH', 'Native session identity was already bound to another assignment')
  } else writePrivate(file, JSON.stringify(saved))
}

function prepareReasonixBoundary({ nativeRoot, launchRoot, record, targetPath, scratchPath, readOnly, checkerScratch }) {
  const boundary = require('../../../scripts/harness-v2-tool-boundary.cjs')
  const candidate = checkerScratch ? path.resolve(checkerScratch.frozenCandidateRoot) : targetPath
  // Controller state must not be available even through read-only file tools.
  const privateRoot = boundary.physical(nativeRoot)
  for (const root of [candidate, scratchPath]) {
    const physicalRoot = boundary.physical(root)
    if (inside(physicalRoot, privateRoot) || (inside(privateRoot, physicalRoot) && root !== scratchPath)) {
      throw new ReasonixError('ROLE_POLICY_DENIED', 'Reasonix task roots overlap protected controller state')
    }
  }
  const toolRoot = path.join(launchRoot, 'tools')
  privateDirectory(toolRoot)
  return boundary.prepareBoundary({ provider: 'reasonix', root: toolRoot, policy: {
    schemaVersion: 1, activationId: record.activationId, sessionId: record.sessionId, reservationId: record.reservationId,
    readOnly, toolFree: record.providerToolCallLimit === 0, targetPath: candidate, scratchPath,
    readableRoots: [candidate, scratchPath], writableRoots: readOnly ? [scratchPath] : [candidate, scratchPath],
    nestedDispatch: false, commandBoundary: true, externalWrites: false,
  } })
}

class ReasonixExecAdapter {
  constructor(options = {}) {
    if (!options.runner?.run || !options.runner?.stop || !options.nativeRoot || !options.connection || !options.executableBinding) {
      throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix transport requires an owned runner, native root, connection, and bound executable')
    }
    Object.assign(this, options)
  }

  async launch(record) {
    const mission = core.validateCanonicalMissionLaunch(record)
    // Native continuation keeps its context, while each physical process has
    // a reservation-scoped identity in the controller's ownership registry.
    const processSessionId = `native-reasonix-${sha256(JSON.stringify([record.sessionId, record.reservationId]))}`
    const binding = this.executableBinding
    if (sha256(readBound(binding.path)) !== binding.sha256) throw new ReasonixError('PROVIDER_UNSUPPORTED', 'Reasonix executable changed after activation')
    const actualRuntime = require('../../../scripts/harness-v2-native.cjs').runtimeDependencyIdentity(binding.path, record.environment || process.env)
    if (!binding.runtimeIdentity || JSON.stringify(actualRuntime) !== JSON.stringify(binding.runtimeIdentity)) {
      throw new ReasonixError('PROVIDER_IDENTITY_MISMATCH', 'Reasonix native dependencies changed after activation')
    }
    const execution = record.physicalExecutionPolicy
    if (!execution || execution.logicalRole !== record.logicalRole || execution.providerRole !== record.providerRole || execution.physicalRole !== record.physicalRole || !['read-only', 'workspace-write'].includes(execution.sandboxMode)) {
      throw new ReasonixError('ROLE_POLICY_DENIED', 'Reasonix dispatch has no exact physical role policy')
    }
    const targetPath = path.resolve(record.workingDirectory || record.cwd || this.targetPath)
    const readOnly = execution.sandboxMode === 'read-only'
    const sessionRoot = nativeContextRoot(this.nativeRoot, record, targetPath)
    const launchRoot = path.join(sessionRoot, sha256(record.reservationId))
    const checkerScratch = record.checkerScratchBoundary ? this.checkerScratchVerifier?.(record) : null
    if (record.checkerScratchBoundary && !checkerScratch) throw new ReasonixError('CHECKER_SCRATCH_BOUNDARY_INVALID', 'Missing authenticated checker scratch boundary')
    const scratchPath = checkerScratch ? targetPath : path.join(launchRoot, 'scratch')
    if (record.externalLocalBoundary || record.externalOperation) throw new ReasonixError('EXTERNAL_WRITE_BOUNDARY_UNAVAILABLE', 'Reasonix controlled tools support only the assigned candidate and checker scratch')
    const cwd = path.join(sessionRoot, 'cwd')
    privateDirectory(scratchPath)
    privateDirectory(cwd)
    const toolBoundary = prepareReasonixBoundary({ nativeRoot: this.nativeRoot, launchRoot, record, targetPath, scratchPath, readOnly, checkerScratch })
    const schema = core.codexProviderCanonicalOutputSchema(record, JSON.parse(readBound(this.outputSchemaResolver(record)).toString('utf8')))
    const outcomeProjection = nativeOutcomeDescriptionProjection(record, schema)
    const wireSchema = outcomeProjection ? outcomeProjection.wireSchema : schema
    const prompt = this.rolePrompt(record.providerRole)
    const toolFree = toolBoundary.policy.toolFree === true
    const systemPrompt = [prompt, '',
      ...(toolFree ? ['This assignment permits no tool calls, including todo_write. Use only the supplied assignment context.'] : [
      'The external controller owns all dispatch and finalization. Do not start another agent or load skills. Run commands in the foreground and wait for their exit status; do not background commands.',
      `Use ${CONTROLLED_PROXY} with action="call", one exact capability_id below, and the tool input in arguments for all work. Every individual call in a parallel batch must explicitly include action="call"; omitting it is not a shortcut. The only native-tool exception is direct todo_write for a read-only checklist that mirrors the assigned work; it grants no authority and does not replace controller dispatch, checks, or acceptance. Do not call direct MCP names, other native tools, ask, discovery actions, or other capabilities.`,
      'Before changing any files, first call direct todo_write with a concrete checklist of the controller-assigned work. Keep its progress truthful: at most one item may be in_progress; leave later work pending and mark finished items completed. Reasonix requires this native bookkeeping for multi-file changes; the checklist never authorizes dispatch, certifies tests, or overrides the controller assignment.',
      ...controlledToolProtocolProjection(targetPath, scratchPath),
      JSON.stringify(TOOLS.map(tool => ({ capability_id: `mcp-tool:${CONTROLLED_SERVER}/${tool.name}`, description: tool.description, arguments_schema: tool.inputSchema }))),
      ]),
      `The exact workspace for this assignment is ${JSON.stringify(targetPath)}. Use absolute paths or explicitly change the command working directory to this workspace.`,
      `Private temporary check files belong only in ${JSON.stringify(scratchPath)}.`,
      'For every controller bash call, omit cwd unless it is exactly the controller-provided workspace or private scratch absolute path. Never use the native runtime current directory, HOME, configuration, session, or tool-control path as cwd; those are private controller state and are denied.',
      ...core.codexPrivateWorkspaceProjection(record, record.canonicalTargetPath || this.targetPath, targetPath),
      ...core.codexExplicitExternalLocalProjection(record, record.canonicalTargetPath || this.targetPath),
      ...core.codexCheckerScratchProjection(record, record.canonicalTargetPath || this.targetPath, targetPath, checkerScratch),
      'FINAL RESPONSE WIRE FORMAT: your final assistant message must be exactly one JSON object. Its first byte must be "{" and its last byte must be "}". Emit no prose, explanation, label, Markdown fence, or characters before or after that object. The decoded object must satisfy the complete canonical schema below.',
      core.nativeCompactCanonicalOutputContract(record, schema, { omitControllerOwnedDescription: Boolean(outcomeProjection) }),
      outcomeProjection ? 'For this controller-owned outcome schema, omit the top-level description. The controller derives its exact literal from code only after validating every other wire field. If payload.evidenceIds is supplied, use unique nonempty strings identifying evidence you actually consumed (identifiers or actual hashes), never objects or invented evidence.' : '',
      'Return that one JSON object conforming to this result schema:',
      JSON.stringify(wireSchema),
    ].join('\n')
    const home = path.join(launchRoot, 'home')
    const quotaEnabled = record.providerTokenLimit !== undefined
    if (quotaEnabled && (!Number.isSafeInteger(record.providerTokenLimit) || record.providerTokenLimit <= 0)) {
      throw new ReasonixError('BUDGET_CONFIG_INVALID', 'Reasonix quota requires a positive safe token allowance')
    }
    const argv = ['run', '--permission-mode', 'dontAsk', ...(toolFree ? [] : ['--allowed-tools', [...CONTROLLED_TOOLS, ...CONTROLLED_NATIVE_TOOLS].join(',')]), '--output-format', 'stream-json', '--dir', cwd, '--max-steps', '100']
    if (record.assignment?.model) argv.push('--model', record.assignment.model)
    if (record.assignment?.effort) argv.push('--effort', record.assignment.effort)
    if (record.continuationId) argv.push('--resume', record.continuationId)
    const stream = new ReasonixEventStream({ ...record, ...(quotaEnabled ? { onUsageDelta: undefined } : {}), toolBoundary, readOnly, onSessionIdentified: (sessionId, evidence) => {
      persistNativeContext(this.nativeRoot, sessionRoot, record, targetPath, sessionId)
      record.onSessionIdentified?.(sessionId, evidence)
    } })
    let streamError
    let stopPromise
    const stop = error => {
      if (streamError) return
      streamError = error
      stopPromise = Promise.resolve().then(() => this.runner.stop({ sessionId: processSessionId, reason: error.code || 'CHILD_RUNTIME_FAILURE', terminalStatus: 'FAILED' }))
      stopPromise.catch(() => {})
    }
    const input = JSON.stringify({
      mission, missionBinding: record.missionBinding,
      dispatch: core.modelVisibleDispatch(record.dispatch, { canonicalAssignment: Boolean(record.canonicalAssignment), canonicalMission: mission, missionBinding: record.missionBinding }),
      assignment: record.canonicalAssignment,
    })
    const environment = { ...record.environment, ...this.credentialEnvironment,
      HOME: home, USERPROFILE: home, XDG_CONFIG_HOME: path.join(home, 'xdg-config'),
      XDG_STATE_HOME: path.join(sessionRoot, 'xdg-state'), XDG_CACHE_HOME: path.join(sessionRoot, 'xdg-cache'),
      REASONIX_HOME: home, REASONIX_STATE_HOME: path.join(sessionRoot, 'state'), REASONIX_CACHE_HOME: path.join(sessionRoot, 'cache') }
    const signal = record.signal || record.abortSignal
    const abort = () => stop(new ReasonixError('CHILD_CANCELLED', 'Reasonix execution was aborted'))
    if (signal?.aborted) throw new ReasonixError('CHILD_CANCELLED', 'Reasonix execution was aborted before launch')
    signal?.addEventListener('abort', abort, { once: true })
    let result, quotaRelay, runnerStarted = false
    try {
      let projectedConnection = this.connection
      if (quotaEnabled) {
        const projection = reasonixQuotaConnection(this.connection, record)
        quotaRelay = await (this.quotaRelayFactory || createQuotaRelay)({ record, upstreamBaseUrl: projection.upstreamBaseUrl, protocol: projection.protocol, onFailure: stop })
        projectedConnection = projection.project(quotaRelay.baseUrl)
      }
      if (signal?.aborted || streamError) throw streamError || new ReasonixError('CHILD_CANCELLED', 'Reasonix execution was aborted during quota preparation')
      writePrivate(path.join(home, 'config.toml'), renderConfig({ connection: projectedConnection, systemPrompt, targetPath, scratchPath, readOnly, checkerScratch: Boolean(checkerScratch), toolBoundary }))
      writePrivate(path.join(home, '.env'), renderCredentials(projectedConnection, environment))
      runnerStarted = true
      result = await this.runner.run({
        executable: binding.path, argv, cwd, env: environment, stdin: input, shell: false,
        sessionId: processSessionId, reservationId: record.reservationId,
        onTransportActivity: record.onTransportActivity,
        onStdoutLine: line => {
          // Already-admitted native responses can deliver exact usage while the
          // owned process drains. Preserve the first cancellation/error while
          // still validating those native receipts; terminal success stays
          // forbidden by the streamError check after the runner settles.
          try { stream.push(line) } catch (error) { stop(error) }
        },
      })
    } catch (error) {
      if (runnerStarted) stop(error)
      else streamError ||= error
    } finally {
      signal?.removeEventListener('abort', abort)
      if (quotaRelay) {
        try { await quotaRelay.close() } catch (error) { stop(error) }
      }
    }
    if (stopPromise) {
      let stopped
      try { stopped = await stopPromise } catch (error) {
        if (error && typeof error === 'object' && !error.cause) error.cause = streamError
        throw error
      }
      if (stopped?.drained !== true) throw new ReasonixError('PROCESS_DRAIN_TIMEOUT', 'Reasonix cancellation did not drain its owned process group')
    }
    if (streamError) throw streamError
    if (result?.processOwned !== true || result.exactArgv !== true || result.drained !== true) {
      throw new ReasonixError('PROCESS_DRAIN_TIMEOUT', 'Reasonix child did not prove owned process completion and descendant drain')
    }
    if (result.status !== 0 || result.signal) {
      throw new ReasonixError('CHILD_RUNTIME_FAILURE', 'Reasonix process failed or was cancelled after producing output', { status: result.status, signal: result.signal || null })
    }
    require('../../../scripts/harness-v2-controlled-tools.cjs').assertStopped(toolBoundary)
    const parsed = stream.finish()
    if (quotaRelay) {
      const authoritative = quotaRelay.snapshot().cumulative
      if (Object.keys(authoritative).some(key => parsed.usage[key] !== authoritative[key])) {
        throw new ReasonixError('PROVIDER_USAGE_UNKNOWN', 'Reasonix native terminal usage differs from the owned provider receipt')
      }
      parsed.usage = authoritative
    }
    let canonicalOutput = parsed.output
    if (outcomeProjection) {
      try { canonicalOutput = outcomeProjection.toCanonical(parsed.output) } catch (error) {
        if (error?.code === 'NATIVE_WIRE_PROJECTION_INVALID') {
          throw new ReasonixError('CHILD_RESULT_INVALID', error.message, error.details)
        }
        throw error
      }
    }
    const validation = validateJsonSchema(schema, canonicalOutput)
    if (!validation.valid) throw new ReasonixError('CHILD_RESULT_INVALID', 'Reasonix result does not match its canonical schema', { errors: validation.errors })
    const output = core.checkerResultBoundToCommandExecutionEvidence(canonicalOutput, parsed, record)
    const transportEvidence = outcomeProjection
      ? { ...core.codexTransportEvidence(parsed), nativeWireProjection: outcomeProjection.metadata }
      : core.codexTransportEvidence(parsed)
    const assembled = {
      ...output, candidateHash: record.candidateHash || output.candidateHash || null,
      contextId: parsed.sessionId, transportEvidence,
      toolReceiptHashes: parsed.toolReceiptHashes,
      usage: parsed.usage, usageStreamed: typeof record.onUsageDelta === 'function',
      evidenceHashes: output.evidenceHashes || [],
      recommendation: output.recommendation || (record.logicalRole === 'route-analyst' ? output : null), completionRequested: true,
    }
    const final = record.normalizeTerminalResult ? record.normalizeTerminalResult(assembled) : assembled
    record.onTerminalResult?.(final, { rawOutputHash: parsed.rawOutputHash, eventStreamHash: parsed.eventStreamHash, sessionId: parsed.sessionId, ...(outcomeProjection ? { nativeWireProjection: outcomeProjection.metadata } : {}) })
    return final
  }
}

module.exports = { ReasonixEventStream, ReasonixExecAdapter, controlledToolProtocolProjection, nativeContextRoot, persistNativeContext, prepareReasonixBoundary, reasonixQuotaConnection }